SMS of Death lets attackers crash Android call services with a hidden, zero-click message, blocking phone calls, even emergency calls too. A specially manipulated SMS message is enough to crash Android’s phone service, interrupt ongoing calls, and temporarily render the smartphone unusable. The attack requires no interaction from the victim and can even compromise the ability to contact emergency services. The vulnerability, dubbed the SMS of Death, is bringing renewed attention to the security of the messaging system in Android smartphones. The issue, documented by independent researcher Mark Blaszczyk, allows a remote attacker to cause a disruption in phone service by sending a single, specially crafted WAP Push message. WAP Push (Wireless Application Protocol Push) is a particular message transmitted over the mobile network, generally in the form of a binary SMS, which contains structured data and is processed automatically by the smartphone without requiring user intervention. Unlike a traditional SMS, it can carry notifications, links to Internet resources, and configurations for mobile services. The most worrying aspect is the execution method. It’s a zero-click attack, in which the recipient doesn’t have to open the message, select a link, or authorize any action. The content is automatically processed by the operating system and can cause the process responsible for phone functionality to crash. The vulnerability affects “WapPushOverSms“, an Android framework component located in the “frameworks/opt/telephony” path, responsible for interpreting and managing WAP Push messages received by the device. The technical cause lies in the incorrect handling of a numeric value used during message interpretation. Specifically, the “decodeWapPdu()” function, the researcher explains, reads the length of the WSP header through a value encoded as “uintvar” , initially returned as a 64-bit number. The value is subsequently converted to a 32-bit integer without prior range checking. This operation can transform a seemingly valid number into a negative value, which is then used to determine the size of an array. The consequence of this is a “NegativeArraySizeException” exception, thrown when Android attempts to allocate a negative-sized array. The exception is not handled correctly in the processing path and causes the “com.android.phone” process, responsible for telephony functions, to terminate. The researcher demonstrated that a five-byte WSP header can generate the value “-2147483648“, which is sufficient to trigger the issue. Therefore, it is not necessary to transmit particularly large amounts of content to cause the issue. “A 5-byte uintvar of 88 80 80 80 00 decodes to 0x80000000. Cast to a signed 32-bit int, that is -2147483648. Allocating new byte[-2147483648] throws an uncaught NegativeArraySizeException on the telephony main thread, killing com.android.phone:” reads the analysis. An invisible attack that also interrupts emergency calls The message is transmitted as a data SMS via the WAP Push channel on port 2948. Unlike a regular SMS, it isn’t displayed in the message inbox and doesn’t generate a user-recognizable notification. The sender’s number isn’t normally visible in the conversation, and when the device receives the message, Android automatically starts processing it. A crash in the phone process causes a temporary loss of connectivity and interrupts active voice calls, including those to emergency services. According to the researcher’s published evidence, each message processing can cause a disruption in telephone service lasting about one to two seconds, during which the component is rebooted. However, the problem can become much more serious if the message is processed repeatedly. One of the most significant aspects of SMS of Death is the ability to transform a simple crash into a persistent Denial of Service condition. The malicious message can remain in the incoming SMS queue and be reprocessed during subsequent delivery attempts. The telephone operator’s retransmission mechanism can also contribute to a repeat of the event, causing further service disruptions. The researcher reports observing intermittent crashes for up to a week after receiving a single message. Sending around twenty specially crafted messages can render the device unusable for an extended period. In more severe cases, the phone process can continue to crash during system startup, triggering a condition similar to a boot loop. Recovery may require using the Android Debug Bridge (ADB) on a computer, directly intervening in the queue of messages waiting to be processed. For a typical user, this is far from a simple procedure. A threat to communications availability SMS of Death demonstrates how a cyberattack doesn’t necessarily have to involve information theft, code execution, or device control to have significant consequences. In this case, the target is phone service availability, a crucial feature especially when contacting emergency services. The ability to interrupt communications without any user interaction makes this vulnerability particularly sensitive. To reduce exposure, it’s important to check the Android security patch level installed and apply available updates, paying particular attention to devices no longer receiving manufacturer support. Testing conducted by Mark Blah has shown that the issue is reproducible on several devices, including the Google Pixel 9 and Samsung smartphones from the Galaxy and Galaxy A families. The vulnerable code appears to be present on Android versions ranging from Android 12 to Android 17. However, the availability of the fix is not uniform across all generations of the operating system. According to documentation published by the researcher, Google has distributed a fix via the October 2026 security update for Android 14, 15, 16, and 17. Older devices, such as those running Android 12 and 13, may remain exposed if they do not receive corrective updates. It's assigned CVE-2026-58882 and a Critical severity in the November 2026 Android Security Bulletin. We've had it listed as one of the patches included in our security preview releases since our 2026072901 release which you can see in the release notes:https://t.co/tBoWBpALw1 — GrapheneOS (@GrapheneOS) October 29, 2026 About the author: Salvatore Lombardo (X @Slvlombardo) Electronics engineer and Clusit member, for some time now, espousing the principle of conscious education, he has been writing for several online magazine on information security. He is also the author of the book “La Gestione della Cyber Security nella Pubblica Amministrazione”. “Education improves awareness” is his slogan. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, SMS of Death)
A critical flaw in Canonical's LXD and MicroCloud let an attacker log in as a trusted client without holding that client's private key. To do it, the attacker had to reach their HTTPS API over the network and have the trusted client's public certificate. Once in, the attacker would act as that client, with access to the cluster and its virtual machines. If the impersonated account is
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys. Northflank is a cloud platform that allows developers to deploy and manage applications, containers, databases, and AI applications without managing the underlying infrastructure. The company disclosed a security incident on October 30, warning customers to immediately rotate their environment variables and API keys after receiving a threat alert from cloud security company Wiz. Soon after, Northflank told all customers to assume their environment variables had been decrypted and that the secrets stored within them were stolen. "Assume all environment variables have been decrypted. Disable/rotate all keys," Northflank warned in an October 30 update.
A security researcher has released a proof-of-concept exploit for a recently patched Android vulnerability, dubbed "SMS of Death" and tracked as CVE-2026-58882, that lets attackers remotely disrupt cellular service or crash phones by sending a specially crafted text message.
American blockchain analysis firm Chainalysis said it was the target of a cybersecurity incident in which an external actor accessed non-sensitive customer data. However, the company noted that the breach did not result in unauthorized access to its investigation content, authentication credentials, or session tokens. "This month, Chainalysis detected an external actor using offensive agentic
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a
Flaws in SS7 and Diameter signaling protocols can allow attackers to track phone locations, intercept calls and SMS verification codes, and impersonate subscribers without compromising their devices. Cape explains how these attacks exploit trust between networks and how its security-focused mobile service helps defend against them.
A hacker leaks personal data on more than 40,000 DHS employees, including CBP, ICE and CISA staff, after an undisclosed breach. Personal details of thousands of U.S. Department of Homeland Security (DHS) employees are now online after a hacker stole reams of data in a data breach that occurred earlier this year and nobody had disclosed. “The breach includes names, job titles, and work contact information, such as email addresses, cell phone numbers, and office locations, of more than 40,000 people who work for the federal department, including border and immigration agents, cybersecurity staffers, and senior department officials.” TechCrunch reports. The incident impacted border and immigration agents, cybersecurity staff and senior department officials. DHS confirmed it is aware of a potential breach and is investigating, saying it takes threats to employees seriously and will provide updates when more information is available. “DHS is aware of a potential breach and is actively working to address the situation swiftly and effectively. We take all security threats against our employees and officers seriously and will work to ensure all are properly protected. We will update the public when more information is available,” a DHS spokesperson told SecurityWeek. The hacker, who uses the name Department of Peace, claims to have stolen the data from an Okta single sign-on system. DHS uses this service to give employees and contractors across its agencies access to the department’s central network. The system also stores IT and login records for each account, showing which systems and internal apps each person can access. The hacker left a note with the leaked data, seen by TechCrunch, saying that if others have their information, it is only fair to share theirs. The malicious actor did not reveal how the U.S. agency was breached. More than half of the records, around 21,000, belong to U.S. Customs and Border Protection (CBP) employees working at airports and other ports of entry. Another 10,000 belong to Immigration and Customs Enforcement (ICE) and its Homeland Security Investigations unit, while just under 1,000 are linked to the cybersecurity agency CISA. Thousands of other records belong to DHS headquarters and agencies such as U.S. Citizenship and Immigration Services and the Federal Protective Service. DDoSecrets says the leaked database identifies officials involved in undercover operations and key DHS personnel overseeing renditions and deportations. Department of Peace said the leak was a response to the government’s actions against ICE. Crimew described the database as an unprecedented view of DHS’s organizational structure, helping researchers identify employees, their roles and reporting lines. They said it could also support investigations and future Freedom of Information Act (FOIA) requests. DDoSecrets co-founder Emma Best said the database, called Icepick, identifies officials involved in covert operations, internal investigations and deportation programs. Ryan Shapiro of Property of the People added that employee contact details could help researchers submit more targeted FOIA requests. Best said the data could also support journalism, congressional inquiries, legal challenges and community investigations. “Rather than an indiscriminate directory of every DHS employee, Icepick identifies many of the architects and drivers of DHS policy and operations,” said journalist and DDoSecrets cofounder Emma Best. “The leak is extraordinary but deceptive in its simplicity as it identifies the officials responsible for overseeing covert and undercover operations, the government’s hunt for leakers and the failed BlueLeaks investigation — along with key personnel in DHS’s ever-escalating rendition and deportation programs.” “By replacing the regime’s anonymity with accountability, Icepick and the tool developed by maia are catalyst for investigations, empowering journalists, Congressional inquiries, legal challenges, community action and Freedom of Information Act requests,” added Best. DHS is investigating a potential breach. Okta says it has no evidence its systems or data were compromised. The breach follows other attacks on U.S. government agencies that exposed FBI records and military personnel data. It is also the second DHS breach this year, after the same hacker claimed to have stolen thousands of government contracts. Journalist maia arson crimew shared the data with DDoSecrets. TechCrunch verified some records, which suggest the database was copied around mid-August. The leak covers about one-fifth of DHS’s 220,000 employees. The records reveal access to tools including Microsoft 365, ChatGPT, Penlink surveillance software and Mobile Fortify, a facial recognition app used by CBP and ICE. Around 4,500 accounts belong to a Headspace user group, while more than 2,000 Homeland Security Investigations employees appear in Penlink-related groups. Researchers say the contact details could help journalists file targeted Freedom of Information Act requests. However, exposing employees’ phone numbers and office locations also creates security and privacy risks. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, DHS)
A Trezor Safe 5 hardware wallet bought from the reseller CryptoBilis has an extra circuit board that sends out the recovery phrase over a mobile network, a customer has reported. Trezor has not yet examined the device. It is telling everyone who bought a Trezor from CryptoBilis since March 2026 to move their funds to a new wallet with a new recovery phrase. Trezor said in a blog post&nbsp
The alert is critical. The fix is known. And the ticket sits in a queue for days. Security teams understand the risk, but the people who keep applications available need proof that the change won’t break anything. Their concerns are practical. An IPS protection could block legitimate traffic. A configuration change could interrupt a service. An endpoint policy could affect an application
Confirm this action.
Leaving now will discard your changes.