What happened
ACR told its players on Saturday morning that it had patched a security vulnerability in its poker client, and that anyone whose antivirus went off should contact support. It did not say what the antivirus would have been going off about.
The notice went up on X at 11:04 a.m. ET. A software bug in the client, it says, created a potential security vulnerability, and ACR deployed a live patch within an hour of identifying the issue. Some players saw brief connectivity problems. ACR's review found no evidence of player account compromise or unauthorized access to account information, and it apologized for the disruption.
It does not say what the bug was, when ACR found it, how long it was live or what the patch changed. Ray Zorfold of The Muck replied to the notice on X at 11:31 a.m. ET: "Could you provide more context as to the nature of the vulnerability or the patch?" As of 12:09 p.m. ET, no reply.
Two days earlier, a player posting as BLESSEDJINGTAO had told followers to be careful on ACR, BCP "or anywhere online" for a bit. Half an hour into a session, he wrote, his antivirus started alerting, and a script tried to run like a million times, unsuccessfully he thought. On Friday at 11:33 p.m. ET, WolfSec0x0 posted that WPN / ACR "was compromised in some way" to the point that it started serving many players malware. WolfSec0x0 is the anonymous account that broke the Mesh Agent case in September. Anyone who played on WPN or any of its skins in the past week, the post said, may have been affected. The post is marked 1 of 2 and says the investigation is early and the poster is on vacation. We could not load the second part.
Neither claim is confirmed. ACR's notice mentions neither, and nothing we can read ties them to it.
WPN has told this story once before. We covered the Mesh Agent case on September 30. On October 3 CEO Phil Nagy said no poker client was believed compromised: the malware had come through third-party software on players' own computers. Saturday's notice is about a bug in the client itself. A bug is not a compromise, and the notice does not call it one.
The notice sits at the top of ACR's October software-update page. The post right below it is titled "ACR Poker Gets Wild with Adult Emojis in the October Software Update."
Why it matters
The notice speaks to accounts: no evidence that any were touched. The two posts are about the players' own computers, which an account review does not measure. If your antivirus alerted while you played on WPN this week, the notice says to contact ACR Poker Support.
