← All stories

Breaches & incidents

Critical Signal Flaw Could Keep Calls Alive After Users Hang Up

By Security Affairs1 min read

A critical vulnerability (CVE-2026-113380, CVSS 9.3) in Signal's calling library could let a malicious caller keep a call active after the victim hangs up, potentially exposing the microphone and camera, Security Affairs reports. Users are urged to update to a fixed version immediately.

Cover for a breaches story

A critical vulnerability in Signal's calling library could allow a malicious caller to keep a call alive even after the victim hangs up, potentially leaving the device's microphone and camera active without the user's knowledge, according to Security Affairs.

The flaw is tracked as CVE-2026-113380 and carries a CVSS severity score of 9.3 out of 10, placing it in the critical range. The issue resides in the library that Signal uses to handle voice and video calls. Security Affairs reports that an attacker on the other end of a call could interfere with the call termination process, preventing the session from ending properly when the victim hangs up.

If exploited, the bug could effectively turn a victim's device into a remote eavesdropping or surveillance tool, with audio and video potentially continuing to flow even though the user believes the call has ended. That poses a serious privacy risk for users of the encrypted messaging app, which is widely regarded as a benchmark for secure communications.

Security Affairs urges Signal users to update to a fixed version of the app immediately to protect against potential exploitation. Until their devices are patched, users may also wish to be cautious about accepting calls from unknown or untrusted contacts, since an attacker would first need to place a call to the victim in order to take advantage of the flaw.

Source: Security Affairs

Cover for a breaches story

Breaches & incidents

Cyberattack on Italy's Chamber of Deputies Highlights Hybrid Warfare Risks

A cyberattack targeted email accounts at Italy's Chamber of Deputies, including a parliamentary account assigned to Prime Minister Giorgia Meloni, Security Affairs reports. The outlet says the incident raises broader questions about hybrid warfare, transparency, and the defenses of European democratic institutions.

1 min read

AI-written summary Source: Security Affairs · Fetched

Cover for a breaches story

Breaches & incidents

Magento Skimmer Campaign Infects 953 Online Stores Across Five Domains

A criminal group has infected 953 online stores, most of them running Magento, in a web skimming campaign active since July 2025, according to Sansec researchers cited by Security Affairs. The attackers hide malicious code in CMS blocks and use five domains and bot filtering to evade detection.

1 min read

AI-written summary Source: Security Affairs · Fetched

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.