Monitor this situation.

Unsubscribe anytime.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

3 clusters · 53 sources · 11 days · First seen 15 days ago · Last updated 4 days ago

Messaging app and mobile security vulnerabilities

Overview

Security researchers have identified several critical vulnerabilities across major messaging platforms and mobile operating systems. In the Signal messaging app, researchers found that macOS encryption keys were stored in plaintext alongside encrypted databases. This flaw, combined with unencrypted storage of attachments, could allow spyware to access sensitive data or clone installations without triggering warnings. Additionally, a vulnerability in Signal’s RingRTC calling library, designated CVE-2026-113380, could lead to a denial-of-service condition where audio or video channels remain active after a user attempts to end a call. Signal released version 2.72.0 to address the calling library issue.

Regarding Android, a remote code execution vulnerability was discovered in the Telegram app. Attackers could execute arbitrary code by making a standard voice call that exploits how the app processes MediaState data. Telegram patched this in version 12.10.4. Furthermore, a zero-click denial of service vulnerability, referred to as the “SMS of Death,” was identified in the Android operating system. Tracked as CVE-2026-58882, the flaw allows attackers to disrupt mobile services by sending a specially crafted WAP Push message. Because the vulnerability resides in how the system processes message header lengths, the malicious message does not appear in the user's inbox and requires no interaction from the recipient. The exploit can cause the “com.android.phone” system process to crash, leading to dropped calls, including emergency services, or even a device bootloop. This issue has affected Google Pixel and various Samsung Galaxy devices. Google has released security updates for Android versions 14 through 17, but devices running Android 12 or 13 may remain vulnerable while awaiting manufacturer-specific patches. Security researcher Mark Blaszczyk noted that receiving approximately 20 such messages can render a device nearly unusable.

Entities

Google · Google Pixel · Samsung · Android · Google Pixel

Claims

What the coverage asserts, and how many sources carry each claim.

[● 23 SOURCES] The vulnerability affects Android versions 12 through 17. www.fehmarn24.de · www.leinetal24.de · ga.de · www.esecurityplanet.com · www.eprice.com.hk · +18 more
[● 3 SOURCES] The vulnerability affects Android versions 12 through 16. trend.dk · www.mobilissimo.ro · kenya-today.com
[● 31 SOURCES] Security researcher Mark Blaszczyk discovered the “SMS of Death” vulnerability. www.fehmarn24.de · www.leinetal24.de · techpulse.be · ga.de · www.ithome.com · +26 more
[● 20 SOURCES] The attack is a zero-click vulnerability requiring no user interaction. www.cellulare-magazine.it · trend.dk · www.mobilissimo.ro · kenya-today.com · securityaffairs.com · +15 more
[● 20 SOURCES] The flaw can cause the telephony process (com.android.phone) to crash. www.cellulare-magazine.it · trend.dk · kenya-today.com · www.mobilissimo.ro · securityaffairs.com · +15 more
[● 19 SOURCES] The attack uses a specially crafted WAP Push SMS. techpulse.be · www.ithome.com · www.esecurityplanet.com · www.aajtak.in · pplware.sapo.pt · +14 more
[● 19 SOURCES] The attack can interrupt emergency calls. techpulse.be · shiftdelete.net · www.tuttoandroid.net · www.esecurityplanet.com · www.aajtak.in · +14 more
[● 15 SOURCES] Google released a security update for Android 14 through 17 in October 2026. www.fehmarn24.de · www.ithome.com · www.universfreebox.com · www.esecurityplanet.com · www.leinetal24.de · +10 more
[● 15 SOURCES] The vulnerability was reproduced on Google Pixel and Samsung Galaxy devices. www.ithome.com · shiftdelete.net · www.tuttoandroid.net · www.esecurityplanet.com · www.eprice.com.hk · +10 more
[● 13 SOURCES] A security vulnerability identified as CVE-2026-58882 exists in the Android operating system. havadis.at · lomazoma.com · www.chip.de · www.dday.it · trn.mk · +8 more

Timeline

4 days ago

[TECHNOLOGY] 13 sources
Android vulnerability dubbed SMS of Death can crash devices
A zero-click Android vulnerability, known as the “SMS of Death” (CVE-2026-58882), allows attackers to crash phones and disrupt emergency calls via malformed WAP Push messages.
6 days ago

[TECHNOLOGY] 41 sources
Android SMS of Death vulnerability allows remote device crashes
A zero-click Android vulnerability known as “SMS of Death” allows attackers to crash phones and disrupt emergency calls using malformed WAP Push messages. Patches are available for Android 14 to 17.
15 days ago

[TECHNOLOGY] 2 sources
Signal messaging app faces critical security vulnerabilities
Signal faces critical security flaws, including plaintext encryption key storage on macOS and a vulnerability in its RingRTC library that can prevent calls from properly hanging up.

Sources

5min.at · aajtak.com · androidsis.com · canaltech.com.br · chiccheinformatiche.com · chip.de · chip.pl · clubz.bg · cybernoz.com · dailyguardian.ae · dday.it · digital.t-online.de · digitaltrends.com · donanimhaber.com · eprice.com.hk · esecurityplanet.com · fehmarn24.de · general-anzeiger-bonn.de · gsmarena.com · havadis.at · hothardware.com · it-boltwise.de · ithome.com · itmagazineme.com · kenya-today.com · kids.pplware.sapo.pt · leak.pt · leinetal24.de · linformatique.org · lomazoma.com · m.eprice.com.tw · mobilissimo.ro · mrmad.com.tw · naniwa-kaigaigurashi.com · novini247.com · pcuser.com.au · pisapapeles.net · securityaffairs.com · shiftdelete.net · smartdroid.de · tbreak.com · techblog.gr · techenet.com · technobaboy.com · techpulse.be · teltarif.de · tomsguide.com · trend.dk

This summary has been updated 3 times: see revision history