NEW TELEMESSAGE SGNL FLAW IS ACTIVELY BEING EXPLOITED BY ATTACKERS

Summary from the TLDR InfoSec newsletter

TeleMessage SGNL, a Signal clone used by US government agencies, has an exposed /heapdump endpoint (CVE-2025-48927) that dumps 150MB memory snapshots containing usernames, passwords, and session data with no authentication required. Attackers are actively exploiting this flaw - CISA added it to the KEV catalog on July 14 and mandated federal agencies patch or stop using the software by July 22. Over 11 IPs have directly targeted this vulnerability, while 2,000+ IPs have scanned Spring Boot Actuator endpoints in the past 90 days, indicating widespread reconnaissance activity.