Invisible SMS of Death Crashes Android Phone Service, Blocking Even Emergency Calls

Security researcher Mark Blaszczyk has demonstrated an attack that uses a specially crafted, invisible SMS message to crash the telephony service on Android devices. The exploit targets the handler for WAP push messages and triggers an unhandled exception, forcing the phone service to restart and terminating any active calls, including those to emergency services. No user interaction is required, and the malicious message does not appear in normal messaging threads. A series of roughly 20 such messages can render a device unusable for extended periods, with repeated delivery from the carrier potentially creating reboot loops that require a computer to escape. The flaw was reproduced on Google Pixel and Samsung Galaxy devices. A patch addressing the issue is included in the October 2026 security update for Android versions 14 through 17, leaving older unsupported devices exposed.

AntiMalwareOctober 30, 2026Translated from Russian

Read at source

Security researcher Mark Blaszczyk has published details of an attack that uses a specially crafted, invisible SMS message to crash the telephony service on Android devices. The exploit requires no user interaction: the recipient does not need to open the message or tap any link.

The vulnerability resides in the handler responsible for processing service WAP push messages. Malformed data sent in these background messages triggers an unhandled exception, causing the phone application to terminate abruptly. As a result, any ongoing call—including calls to emergency services—is dropped and the device becomes temporarily unable to make or receive calls.

Blaszczyk published technical information on a dedicated project site named SMS of Death. Because the message is a silent service notification, it never appears in the user’s normal SMS conversation list, making it impossible to identify or avoid through normal inspection.

Testing showed that a burst of approximately 20 such messages can leave a device unusable for a prolonged period. The situation is worsened by automatic message redelivery: mobile operators continue retransmitting unacknowledged messages, repeatedly triggering the crash. In some cases this creates a reboot loop that can only be escaped by connecting the device to a computer.

The researcher successfully reproduced the denial-of-service condition on Google Pixel and Samsung Galaxy handsets. According to his findings, the corrective patch was incorporated into the October 2026 security update for Android versions 14 through 17. Devices that have reached end-of-support and no longer receive monthly updates remain vulnerable.

Google Pixel Mark Blaszczyk SMS of Death Samsung Galaxy

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulnerabilities & Exploits

Vulnerabilities & Exploits

Managing the Version Zoo: How Enodia Was Built for Service Inventory Tracking EOL and CVE Data

A DevOps engineer developed enodia, an open-source Go-based CLI tool, to solve the problem of tracking hundreds of service versions across infrastructure, including PostgreSQL, MySQL, nginx, Debian, and Jira. The tool collects real versions through product-specific probes, then cross-references them against endoflife.date calendars and CVE databases from NVD and Russia's FSTEC BDU. It separates collection and evaluation phases, uses three independent axes for status (PATCH, LIFECYCLE, BRANCH), and supports air-gapped environments by allowing offline CVE data import. Early versions of the MySQL probe caused self-blocking on servers due to connection error counting, which was fixed by completing authentication attempts. The developer contributed multiple products and historical data back to endoflife.date and added support for ten Linux distributions using vendor OVAL and Security Tracker feeds. The project is distributed as a single AGPL-3.0 binary with YAML configuration and environment-variable credential handling.

HabrOct 30, 2026Translated from Russian

Vulnerabilities & Exploits

Telegram Voice Call Flaw Enables Remote Code Execution on Android Devices

Security researchers disclosed on October 29, 2026 a vulnerability in Telegram for Android that allows arbitrary code execution on a victim's device simply by answering a voice call. The flaw resided in the handling of short MediaState messages exchanged during calls, where missing fields caused the application to read unauthorized memory. Telegram addressed the issue in version 12.10.4 released at the end of September 2026, covering versions from 8.6.2 through 12.10.3 issued between March 2022 and September 2026. The same underlying fix had been deployed earlier in the shared calling library on April 21, 2026, reaching iOS in May, desktop in July, and Android only in September. Researchers confirmed the impact exclusively on private calls running on ARM64 Android devices and found no evidence of exploitation on iOS, desktop, or group calls. Users are advised to check their Telegram version in settings and update immediately, while enterprise administrators should audit device fleets given the four-and-a-half-year span of affected releases.

BoletimSecOct 30, 2026Translated from Portuguese

Vulnerabilities & Exploits

Cisco Talos Details KeyDrift Malware Exploiting Critical CVE-2026-20127 Zero-Day in Catalyst SD-WAN

Cisco Talos published an analysis on October 28, 2026, of the KeyDrift malware set designed to reside inside Catalyst SD-WAN controllers and extract keys protecting inter-site traffic. The initial access vector was the critical CVE-2026-20127 authentication bypass, scored 10.0 on CVSS 3.1, affecting the peer authentication mechanism between the Catalyst SD-WAN Controller, Manager, and Validator. Attackers could obtain administrative privileges remotely without credentials by sending crafted requests. The Cisco patch was released in February 2026 and the CVE was added to the CISA catalog on February 25 with a two-day remediation deadline. KeyDrift consists of two core modules: the memory-resident PolyFlame backdoor injected into vdaemon processes and the LittleFilch component that intercepts decrypted session identifiers and 32-byte AES-256 IPsec keys distributed via the OMP protocol. Observed targets include space and satellite services, defense contractors, aerospace technology firms, and public policy research institutes. Talos assesses with high confidence that the UAT-11473 infrastructure overlaps significantly with the Silent Train access network linked to Volt Typhoon, though the groups are not confirmed to be identical.

BoletimSecOct 30, 2026Translated from Portuguese