TL;DR
AlphaTheta says a PRO DJ LINK vulnerability could let someone with unauthorized network access view data on connected computers or USB/SD media.
The company hasn’t confirmed damage and is withholding technical details while it prepares a fix.
The lesson is bigger than this bug: if your players share files and state, your booth is already a network.
The Ethernet cable behind the decks is easy to forget about.
You connect the players, mixer and switch, insert a USB and get on with playing music. PRO DJ LINK handles the invisible part. Tracks can be shared between devices. rekordbox can feed music into compatible players. Beat, key and status information can move around the booth without you thinking much about the network carrying it.
Most of the time, that’s exactly how infrastructure should feel. Boring.
On August 8, AlphaTheta gave DJs a reason to look at it again.
The company disclosed a security vulnerability affecting PRO DJ LINK in rekordbox and certain CDJ/XDJ models. AlphaTheta says someone who gains unauthorized access to the PRO DJ LINK network could potentially view data stored on a connected Windows PC or Mac, or on USB and SD media inserted into linked players.
AlphaTheta says it hasn’t confirmed any cases of damage. It’s also withholding the technical details until a fix is available, so there’s no useful reason to invent a scarier exploit story around what the company hasn’t published.
The practical lesson is already enough: the booth has a network boundary whether we think about it that way or not.
The Network Behind the Decks
PRO DJ LINK sounds like a feature and the cabling tells you what it really is.
AlphaTheta’s documentation describes a LAN connecting compatible players, mixers and computers running rekordbox. Depending on the setup, music stored on computers, USB drives, SD cards and mobile devices can be shared across multiple players. The same network can carry Beat Sync, key information and device status.
That’s useful because the booth behaves like one connected instrument instead of a pile of separate boxes.
The easy assumption is that the network is mostly carrying timing and performance data. AlphaTheta’s advisory makes the storage side visible too. If an unauthorized party gets onto the PRO DJ LINK network, the company says data on the connected computer or performance media may be viewable.
So the question is no longer only, “Did I export the playlist?”
It’s also, “What’s this setup connected to?”
Updating Is Not the Same as Closing the Issue
The rekordbox release history needs a careful read.
Version 7.2.17, released July 30, says: “Enhanced LINK EXPORT security.” Version 7.2.18 arrived August 18 with Spotify-related changes plus general bug and stability fixes. Its notes don’t say the PRO DJ LINK vulnerability is fully resolved.
I wouldn’t infer more than that. The July release note doesn’t identify which security issue it addresses, and AlphaTheta’s August 8 advisory still says the company is preparing a fix and will post progress updates.
So the live advisory wins over guesses about what a version number might mean.
Update rekordbox anyway. Then check AlphaTheta’s current response-status page for the exact hardware and software you use before assuming the issue is closed.
This is normal performance hygiene with a security consequence attached. Current software matters because compatibility matters. Firmware matters because the player has to behave when you need it. Now the network belongs in the same checklist.
Draw the Booth Once
Before your next set, take thirty seconds and draw the network. Literally.
Player 1. Player 2. Mixer. Switch. Laptop. Wi-Fi access point if there’s one. USB and SD media attached to anything on that network.
You don’t need IP addresses or a security diagram. You’re answering one question: what becomes reachable once something joins this setup?
Then do the easy checks AlphaTheta is already recommending. Keep rekordbox current. Don’t carry sensitive files on the USB or SD media you use with PRO DJ LINK. If the setup uses Wi-Fi, make sure it’s secured and password-protected.
I would add one more practical check: know whether the booth switch or access point is only serving the DJ gear or is tied into something broader at the venue. A closed booth network and a shared network aren’t the same thing.
Don’t turn that into paranoia. AlphaTheta’s advisory specifically requires unauthorized access to the PRO DJ LINK network before the described data exposure becomes possible. The connectivity itself isn’t the problem. It’s why PRO DJ LINK is useful.
The useful part is knowing where that connectivity ends.
Keep the Network Boring
DJs have always carried infrastructure with them: backup USBs, cables, adapters, power supplies. The digital booth just moved more of it out of sight.
PRO DJ LINK lets players share music and state because the booth is connected. That connection is part of the performance path now, even when nothing is wrong with it.
The August advisory doesn’t suddenly make networked DJing unsafe. It makes one assumption visible: the setup works best when the network is trusted.
That’s the part worth keeping after AlphaTheta ships the final fix.
Know what’s connected. Keep the software and firmware current. Keep unrelated private data off performance media. Secure the wireless side if you use it.
Then go back to forgetting about the Ethernet cable.
If you drew your current booth as a network instead of a gear list, what would be connected that you normally never think about?
Resources
AlphaTheta, Important Notice: Security Vulnerability in PRO DJ LINK, August 8, 2026.
AlphaTheta, PRO DJ LINK Vulnerability Response Status, live model/software response page linked from the official advisory.
rekordbox, Release Notes, including version 7.2.17’s “Enhanced LINK EXPORT security” note and version 7.2.18.
AlphaTheta Help Center, What is the Pro DJ Link function? And what link functions are there?.
AlphaTheta Help Center, What features can I use when the unit is connected to the PRO DJ LINK network?.
Source note: AlphaTheta’s response-status page is publicly available and lists each affected model. Most affected players show a status of “fix in progress.” This article doesn’t reproduce the full table, out of respect for AlphaTheta’s own documentation. Check the live page for the exact hardware and software you use. This article stays inside claims available on AlphaTheta’s public advisory and support pages.
Analytical note: the argument that network hygiene is part of performance reliability is my interpretation of how PRO DJ LINK combines file sharing, performance state and connected devices. AlphaTheta has not reported confirmed damage from this vulnerability and has not published the technical details.