Mobil va simsiz aloqa
Signal zaifligi yomon niyatli qo'ng'iroq qiluvchilarga qo'ng'iroqni tugatishni to'sib qo'yish imkonini beradi
Ochiq manbali qo'ng'iroq kutubxonasi RingRTC'ga ta'sir qilgan xato qo'ng'iroqlarning to'g'ri tugashiga to'sqinlik qildi.
Muallif: Ionut Arghire | 2026-yil 22-oktabr (ET soat 8:34)
Signal yomon niyatli qo'ng'iroq qiluvchiga foydalanuvchi qo'ng'iroqni tugatganidan keyin ham audio va video treklarini yoqilgan holda saqlash imkonini beradigan muhim darajadagi zaiflikni bartaraf etdi.
Xavfsizlik nuqsoni CVE-2026-113380 (CVSS balli 9,3) sifatida kuzatiladi va Signal ovozli va video qo'ng'iroqlar uchun foydalanadigan ochiq manbali kutubxona RingRTC'ga ta'sir qiladi, bu WebRTC asosida qurilgan.
Muammo tufayli masofaviy sherik qo'ng'iroqning Cheklangan Holat Mashinasi (FSM) hodisa navbatini axlat bilan to'ldirishi mumkin edi va qo'ng'iroq tugamasdi.
Bu shunday sodir bo'ldi, chunki tugatish o'ldirish tugmasi sifatida emas, balki FSM hodisa navbatiga qo'shilgan hodisa sifatida ko'rib chiqildi; sherikdan kelgan hodisalar uchun tezlik cheklovi yo'q edi; va tugatish hodisasi ustuvorlikka ega emas edi.
"Navbatni axlat bilan to'ldiring va tugatish hujumchi shovqini ortida abadiy kutadi, shuning uchun qo'ng'iroq (mikrofon, ehtimol kamera) hech qachon tugatilmaydi", — deb yozadi tadqiqotchi GitHub'dagi yozuvda.
Zaiflikdan foydalanib, hujumchi jabrlanuvchi qo'ng'iroqni tugatgan deb o'ylagan holda, maqsadli qurilmadan audio va video treklarini oqishda davom ettirishi mumkin edi.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Xavfsizlik nuqsoni 4-sentabrda chiqarilgan RingRTC 2.72.0 versiyasida bartaraf etildi.
Biroq, xato haqida tafsilotlar seshanba kuni e'lon qilindi, shuningdek kontseptual isbot (PoC) ham. NIST CVE'ni NVD ma'lumotlar bazasiga seshanba kuni qo'shdi.
Signal muammoni qo'ng'iroqni tugatish so'rovlari FSM hodisa navbatida to'sib qolmasligi va mustaqil ravishda aniqlanishini ta'minlash orqali hal qildi.
Foydalanuvchilar Signal ilovalarini iloji boricha tezroq yangilashlari kerak. Aks holda, ular qo'ng'iroq haqiqatan ham tugaganini tekshirish uchun qo'ng'iroq indikatorini tekshirishlari kerak.
Bog'liq: Splunk, SolarWinds yangi xavfsizlik yangilanishlarini e'lon qildi
Bog'liq: Cisco bir nechta mahsulotlar bo'yicha 34 zaiflikni tuzatdi
Bog'liq: PHP2Shell ekspluatatsiyasi yamoqlardan bir necha kun oldin boshlandi
Bog'liq: Yuqori darajadagi zaifliklar uch kunda ekspluatatsiya qilindi, ransomware Q3'da ustunlik qildi: Rapid7
Yozgan: Ionut Arghire
Ionut Arghire — SecurityWeek uchun xalqaro muxbir.
Kundalik axborot byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Ionut Arghiredan ko'proq
- Splunk, SolarWinds yangi xavfsizlik yangilanishlarini e'lon qildi
- Cisco bir nechta mahsulotlar bo'yicha 34 zaiflikni tuzatdi
- PHP2Shell ekspluatatsiyasi yamoqlardan bir necha kun oldin boshlandi
- PHP2Shell yamoqlari birinchi ekspluatatsiya urinishlari sensorlarga urilganda yetib keldi
- Chrome'ning 353 yangi xavfsizlik tuzatishlarining aksariyati xotira xatolari
- Brauzerlar eMudhra oraliq CA'larini qayta tiklanadigan shaxsiy kalitlar tufayli blokladi
- Xitoy AI modeli AQSh pudratchisi uchun yozilganda ko'proq buziladigan kod yozadi
- PHP2Shell: Ochiq muhim PHP zaifliklari uchun ommaviy ekspluatatsiya yaqinlashmoqda
So'nggi yangiliklar
- Sobiq 8200-bo'linma ofitserlari agentik SecOps startapi Mave uchun 34 million dollar yig'di
- Boshqa yangiliklarda: Tor chiqish releylari o'g'irlandi, banklar yovuz AI agentlarini aniqladi, o'z-o'zini tiklaydigan macOS ransomware
- Mirai botnet operatorlari PHP2Shell hujumlariga ASLR chetlab o'tish ekspluatatsiyalari paydo bo'lishi bilan qo'shildi
- Xitoy APT ConnectWise hujumlarida AI pentest vositasi Artex'dan foydalanadi
- Hujumchilar to'rt oy ichida uchinchi Arista VCO nol kunini ekspluatatsiya qiladi
- Capcom ma'lumotlar buzilishi 11 million kishiga ta'sir qildi
- Quest Diagnostics ma'lumotlar buzilishi "ma'lum bemor yozuvlari"ni ochib qo'ydi
- LiteLLM yangi ta'minot zanjiri hujumida buzildi
Trendda
Texnologiya va xavfsizlik kompaniyalari PHP2Shell zaifliklariga javob qaytarmoqda
Xitoy APT ConnectWise hujumlarida AI pentest vositasi Artex'dan foydalanadi
Mirai botnet operatorlari PHP2Shell hujumlariga ASLR chetlab o'tish ekspluatatsiyalari paydo bo'lishi bilan qo'shildi
Boshqa yangiliklarda: Tor chiqish releylari o'g'irlandi, banklar yovuz AI agentlarini aniqladi, o'z-o'zini tiklaydigan macOS ransomware
PHP2Shell yamoqlari birinchi ekspluatatsiya urinishlari sensorlarga urilganda yetib keldi
PHP2Shell: Ochiq muhim PHP zaifliklari uchun ommaviy ekspluatatsiya yaqinlashmoqda
Quest Diagnostics ma'lumotlar buzilishi "ma'lum bemor yozuvlari"ni ochib qo'ydi
Signal zaifligi yomon niyatli qo'ng'iroq qiluvchilarga qo'ng'iroqni tugatishni to'sib qo'yish imkonini beradi
Kundalik axborot byulleteni
So'nggi tahdidlar, tendentsiyalar va texnologiyalar, shuningdek soha mutaxassislarining chuqur fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta axborotiga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Vebinar: Google Workspace'dagi AI kirish xavfi allaqachon mavjud
2026-yil 19-oktabr
Google Workspace'ga ulangan AI vositalari millionlab nozik elektron pochta va fayllarga kirishi mumkin. Tashkilotingiz xavfini aniqlash va AI kirishini boshqarish uchun ramka o'rganish uchun ushbu sessiyaga qo'shiling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 Sammiti
2026-yil 10 va 11-noyabr
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantiradigan masalalarni ko'rib chiqish uchun birlashtirgan holda bizga qo'shiling.
Ro'yxatdan o'ting
Harakatdagi odamlar
Cequence Security Russ Schaferni CMO etib tayinladi.
Mona Harrington DHS'da Kiber integratsiya bo'yicha yordamchi direktor etib tayinlandi.
iCOUNTER Mark H. FitzPatrickni CFO etib tayinladi.
Harakatdagi ko'proq odamlar
Mutaxassis fikrlari
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklik
Dasturchilaringiz AI qabul qilish shkalasida qayerda joylashgani sizning xavfsizlik xavfini qanday hal qilishingizga haqiqiy ta'sir ko'rsatadi. (Matias Madou)
Zamonaviy kiberhujumlarga qarshi kurashda kontekst shohdir
Kontekstual himoya xavfsizlik jamoalariga signallarni bog'lash, keyin nima kelishini oldindan bilish va tahdidlarni ular kuchayishidan oldin to'xtatishga yordam beradi. (Etay Maor)
AI hujum tezligini o'zgartirdi, xavfsizlik asoslarini emas
AI zaifliklarni aniqlash va ekspluatatsiya qilishni tezlashtirgan sari, virtual yamoqlash hali ham chuqur himoya va kuchli ilova xavfsizligi asoslariga bog'liq. (Joshua Goldfarb)
Kelajak uchun katta rejalar tuzgan to'rtta kiber tahdid
- AI, ta'minot zanjiri ochiqligi, kvant hisoblash va geosiyosiy ziddiyat xavfsizlik dasturlarini sinovdan o'tkazmoqda. Buzilishlarga tayyorgarlik kundalik operatsiyalarning bir qismiga aylanishi kerak. (Steve Durbin)
Oxiridan boshlang: Agentik tuzatishni qanday yoqish mumkin
Agentik tuzatish ishonch harakati emas. Biz tanish muammolarni tuzatish haqida gapiryapmiz, notanish xavf haqida hukm chiqarish emas. (Nadir Izrael)
Mobile & Wireless
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Affecting the open source calling library RingRTC, the bug prevented calls from ending properly.
By
Ionut Arghire
| October 22, 2026 (8:34 AM ET)
*
Signal has resolved a critical-severity vulnerability that could allow a malicious caller to keep audio and video tracks enabled even after the user hung up.
The security defect is tracked as CVE-2026-113380 (CVSS score of 9.3) and impacts RingRTC, the open source library Signal uses for voice and video calls, which is based on WebRTC.
Due to the issue, a remote peer could flood the call’s Finite State Machine (FSM) event queue with junk, and the call would not terminate.
This happened because the hangup was not treated as a kill switch, but as an event added to the FSM event queue; there was no rate limit on peer-originated events; and the hangup event had no priority.
“Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down,” a GitHub write-up by a researcher reads.
By exploiting the vulnerability, an attacker could keep the audio and video tracks flowing from a target device while the victim believes they ended the call.
Advertisement. Scroll to continue reading.
The security defect was resolved in RingRTC version 2.72.0, which was released on September 4.
Details on the flaw, however, were published on Tuesday, along with a conceptual proof-of-concept (PoC). NIST added the CVE to the NVD database on Tuesday.
Signal resolved the issue by ensuring that call termination requests do not remain blocked in FSM’s event queue and are detected independently.
Users should update their Signal applications as soon as possible. Otherwise, they should check the call indicator to make sure the call indeed ended.
Related:Splunk, SolarWinds Release Fresh Security Updates
Related:Cisco Patches 34 Vulnerabilities Across Multiple Products
Related:PHP2Shell Exploitation Started Days Before Patches
Related:High-Severity Flaws Exploited in Three Days as Ransomware Dominates Q3: Rapid7
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Splunk, SolarWinds Release Fresh Security Updates
- Cisco Patches 34 Vulnerabilities Across Multiple Products
- PHP2Shell Exploitation Started Days Before Patches
- PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
- Memory Bugs Account for Most of Chrome’s 353 New Security Fixes
- Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys
- Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
- PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Latest News
- Former Unit 8200 Officers Raise $34 Million for Agentic SecOps Startup Mave
- In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
- Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
- China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
- Attackers Exploit Third Arista VCO Zero-Day in Four Months
- 11 Million Impacted by Capcom Data Breach
- Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
- LiteLLM Compromised in Fresh Supply Chain Attack
Trending
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Mirai Botnet Operators Join PHP2Shell Attacks as ASLR Bypass Exploits Emerge
In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS Ransomware
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
Quest Diagnostics Data Breach Exposed ‘Certain Patient Records’
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Cequence Security has appointed Russ Schafer as CMO.
Mona Harrington has been named Assistant Director for Cyber Integration at DHS.
iCOUNTER has appointed Mark H. FitzPatrick as CFO.
More People On The Move
Expert Insights
*
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)
Context Is King in the Fight Against Modern Cyberattacks
Contextual defense helps security teams connect the signals, anticipate what comes next, and stop threats before they escalate.(Etay Maor)
AI Has Changed Attack Speed, Not Security Fundamentals
As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals.(Joshua Goldfarb)
Four Cyber Threats Harboring Big Plans for the Future
- AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations.(Steve Durbin)
Begin at the End: How to Enable Agentic Remediation
Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk.(Nadir Izrael)