For professionals in communications, marketing, and PR who rely on secure channels to manage sensitive conversations, these revelations are more than just technical footnotes. They raise urgent questions about how secure our “secure” tools really are, and what’s at stake when those tools fall short. And when even the most trusted platforms show cracks, the consequences stretch far beyond the IT department. Users can link their account to desktop applications, which are often less secure than mobile devices.
Those working in government should follow government guidance on the use of non-corporate communications channels. SafeBreach reported these findings to Google’s Vulnerability Reward Program on August 17, 2025. By November 14, 2025, Google confirmed the deployment of content classifier updates that effectively countered the described attack methods.
The discovery also revealed that around half of the numbers leaked in the massive Facebook scraping of 2021 were still active on WhatsApp, demonstrating that phone numbers, in practice, function as a near-permanent identifier. Thanks to this weakness, researchers demonstrated that it was possible to query more than 100 million phone numbers per hour through WhatsApp’s infrastructure, ultimately enumerating some 3.500 billion active accounts in 245 countries. The system responded to an enormous number of requests from a single source, when the reasonable course of action would have been to reject or limit them.
JSBridge interfaces, which enable web-to-native functions like scanQRCode, are tightly controlled via cloud-based permission arrays, limiting access for untrusted sites. The application uses cloud-based permission arrays to control JSBridge interface access, providing fine-grained control over webpage capabilities. Mini-program ecosystems introduce additional attack surfaces, as third-party developers receive extensive system permissions including file system access, sensor invocation, and API calls. TeleMessage is similar to the Signal App but allows for the archiving of chats for compliance purposes. Based in Israel, the company was acquired by US company Smarsh in 2024, before temporarily suspending services after a security breach in May that resulted in files being stolen from the app.
Core Dump Exposure Flaw (cve-2025-
Clicking on it, instead of a backup, downloads malicious software that can steal data, take control of the account, or even persistently infect the device. When we move from the mobile version to the desktop versions, things get even more complicated. The vast majority of desktop messaging clients are built on Electron, a framework that encapsulates a web application within a Chromium browser . This is very convenient for developers because it allows them to create a “native” app for multiple operating systems simultaneously, but it also means inheriting Chromium’s inherent vulnerabilities.
- The imagent process has been a frequent target for sophisticated attackers, having been exploited in previous high-profile campaigns including FORCEDENTRY and BLASTPASS operations.
- Teaching employees how to spot suspicious links, question unexpected group invites, and verify QR codes can prevent many of these attacks before they start.
- They strike at the heart of trust, trust between colleagues, between brands and customers, and between organizations and the public.
Buying Or Selling A Second-hand Phone? How To Protect Your Personal Data
For developers, prioritizing security without compromising usability is the ultimate challenge one that will define the next era of digital communication. This misconfiguration allows unauthorized attackers to access memory dumps containing potentially sensitive information, including authentication credentials, session tokens, and other confidential data stored in the application’s memory space. Vulnerabilities found in Signal, Google Duo, Facebook Messenger, and other messaging apps allowed attackers to listen in on users without their permission, security experts have warned. In the Telegram channel linked in the notification, the administrator of the so-called ‘Xuanye Group,’ also said that payment information is not affected. ASOS also confirmed customers that its website and app are operating as normal, and that the company’s operations are fully unaffected.
Backdoor vulnerabilities in chat models comprise a set of exploitable weaknesses whereby LLMs, including instruction- or conversation-tuned systems, are induced to emit attacker-specified outputs under rare or covert triggering conditions. These vulnerabilities are realized through diverse mechanisms—data poisoning, structural manipulation, reward-model hijacking, template abuse, or post-deployment context injection—and persist across both system architectures and defense paradigms. These platforms handle critical activities including social interactions, financial transactions, and business communications for billions of users globally, making successful attacks particularly devastating.
The less information that’s publicly available, the harder it will be for an attacker to create a convincing scam or link your number to other leaked data. In organizations like the Balearic Islands Health Service , instant messaging has become an essential tool for rapid communication between professionals, but that doesn’t mean you can use just any app you have on your personal phone. In the case of WhatsApp, phone numbers of all contacts, device data, usage patterns, group memberships , profile pictures, status messages, IP addresses, location data, and even payment information (where available) are instan-talks.com systematically collected. This data can be used to reconstruct social and professional networks, internal relationship maps within a company, travel habits, and even organizational hierarchies. The imagent process has been a frequent target for sophisticated attackers, having been exploited in previous high-profile campaigns including FORCEDENTRY and BLASTPASS operations. It might mean setting clear policies about which tools can be used for what kinds of content.
Critical Gitea Vulnerabilities Allow Attackers To Bypass Authentication And Execute Code
Organizations must also monitor network traffic for unusual outbound HTTP requests originating from WhatsApp clients, which may indicate exploitation attempts. Follow the Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive (BOD) requirements for cloud service security, including multi-factor authentication and robust logging of all synchronization events. Enforce the vendor’s configuration guidance, ensuring that linked-device synchronization messages are permitted only from authenticated endpoints. Organizations and individual users are strongly urged to apply vendor-supplied mitigations by September 23, 2025, or to discontinue use until secure patches are available. Researchers say the surge in SMS spam coincides with new features added to a popular commercial phishing kit sold in China that makes it simple to set up convincing lures spoofing toll road operators in multiple U.S. states.
This is complemented by double-layer post-quantum encryption, based on NIST-standardized algorithms, designed to withstand both current attacks and future “capture now, decrypt later” scenarios when quantum computing becomes a realistic threat. Their vulnerabilities are quickly researched and exploited, and Google typically responds with frequent patches. The problem is that Electron-based programs don’t always update their embedded engine at the same pace, so a vulnerability already fixed in the browser can remain active for months in a desktop messaging client. A previously unknown zero-click vulnerability in Apple’s iMessage appears to have been exploited by sophisticated threat actors targeting high-profile individuals across the United States and the European Union. On November 29th, Lachlan Davidson reported a security vulnerability in React that allows unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React Server Function endpoints.
Signal’s security flaw was patched in September 2019, and the rest of the messaging apps were fixed more recently in the second half of 2020. The Project Zero researcher also looked at other popular messaging apps such as Telegram and Viber, but she could not find these particular security flaws. She looked at Telegram in August 2020, and Viber was investigated in November last year. Back in November 2018, the very same researcher brought to daylight a similar loophole in WhatsApp – it was affecting not only Android users, but the security flaw was observed on Apple devices too.
Alongside international partners, the NCSC has issued actions for individuals at risk of targeted attacks against messaging apps. The core exploit leverages Gemini’s Android Utilities agent, specifically the tool that reads incoming notifications. Because this tool processes untrusted data from third-party apps, an attacker can embed malicious instructions directly inside a crafted message. The discovered security flaws would allow a call to connect to a receiving device without notifying the receiver in any way. Hackers then listened quietly and, in some cases, even turned the camera on without alerting the owner of the targeted device. Many less popular applications have not been researched, and it is currently unknown if this security fault could be observed there.
Globe Threat Map provides a real-time, interactive 3D visualization of global cyber threats. Monitor DDoS attacks, malware, and hacking attempts with geo-located arcs on a rotating globe. Large-scale social engineering schemes are on the rise, fabricating messages from trusted contacts without prior knowledge of the contacts’ names by extracting real sender names from the notification queue. This time, the attack surface is far larger; any application capable of triggering a device notification becomes a viable delivery vector.
The fallout could be disastrous, not just in terms of the breach itself, but in how it undermines trust with clients, stakeholders, and the public. React provides integration points and tools that frameworks and bundlers use to help React code run on both the client and the server. React translates requests on the client into HTTP requests which are forwarded to a server. On the server, React translates the HTTP request into a function call and returns the needed data to the client.
