Per AlphaTheta's own security notice, published August 8, 2026 on rekordbox.com, the company has found a hole in PRO DJ LINK, the local-network protocol that quietly runs behind almost every professional booth on earth.
What did AlphaTheta actually disclose?
PRO DJ LINK is the layer that lets multiple CDJ and XDJ units, a mixer and a laptop running rekordbox talk to each other over a shared local network during a set: track metadata, tempo, waveforms, cue points, the stuff that makes a clean handover between two players possible without anyone touching a cable twice. AlphaTheta's notice says it identified a vulnerability affecting that function in rekordbox and in certain CDJ/XDJ models. The company is deliberately not publishing how the flaw works, to stop anyone using the writeup as a how-to before a fix is out.
Why should a working DJ care about a shared network?
Here's the part that should get attention in the booth: AlphaTheta says an unauthorized third party who gains access to a PRO DJ LINK network could view data stored on a Windows PC or Mac connected to it, or on a USB or SD card sitting in a linked CDJ or XDJ. A club or festival booth is exactly the kind of shared, semi-open network this describes: back to back sets, guest laptops plugged in for a warm-up, a rider full of unknown devices on the same switch by the end of the night. None of that used to feel like an attack surface. AlphaTheta's notice is the first time the company has said, in writing, that it can be one.
What should you do about it right now?
AlphaTheta has not confirmed a single case of actual damage from this so far, and it is withholding the technical detail on purpose, so there is no proof-of-concept to worry about today. What it has given DJs is a fix: update rekordbox, both Ver. 7 and Ver. 6, on desktop and on the iOS/Android apps, to the latest version. That's the entire remedy on offer until AlphaTheta ships more, and it costs nothing to do before your next gig.
Why it matters
For touring DJs and clubs, this is a reminder that a gig network is a shared space by design: the same protocol that makes seamless handovers possible also puts everyone briefly on the same local network as strangers. A patched rekordbox is the only fix on offer until AlphaTheta releases more.
What we think
Credit where it's due: AlphaTheta chose a plain public disclosure over staying quiet, and the vague wording is standard security practice, not evasiveness, you don't hand attackers a map before the door is fixed. That said, we'd like to see clubs start treating a rekordbox update the way they already treat CDJ firmware before a big weekend: routine, not optional, checked at soundcheck.
