[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"public-config":3,"i-flag:ph-4x3":14,"i-flag:us-4x3":19,"i-flag:de-4x3":21,"i-flag:hk-4x3":23,"i-tabler:lifebuoy":25,"i-tabler:timeline":28,"i-tabler:apps":30,"i-tabler:package":32,"i-tabler:circle-half-2":34,"i-tabler:sun":36,"i-tabler:moon":38,"i-tabler:menu-2":40,"i-tabler:user":42,"i-tabler:notebook":44,"i-simple-icons:forgejo":46,"i-tabler:shield-lock":48,"i-tabler:tools":50,"i-tabler:calendar":52,"i-tabler:x":54,"$f3fo5ijwymi8x2":56,"i-tabler:arrow-left":120,"i-tabler:tag":122},{"matomo":4,"booking":7,"site":9,"blog":11,"newsletter":12},{"enabled":5,"siteId":6},true,"7",{"enabled":5,"url":8},"https:\u002F\u002Fcal.com\u002Fjdbungart",{"url":10},"https:\u002F\u002Fjdneer.com",{"enabled":5},{"enabled":13},false,{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":18},0,640,480,"\u003Cpath fill=\"#0038a8\" d=\"M0 0h640v240H0z\"\u002F>\u003Cpath fill=\"#ce1126\" d=\"M0 240h640v240H0z\"\u002F>\u003Cpath fill=\"#fff\" d=\"M415.7 240L0 480V0\"\u002F>\u003Cpath fill=\"#fcd116\" d=\"M26.7 42.4L41 55l16.6-9.2l-7.4 17.5l14 13l-19-1.6l-8.1 17.2l-4.3-18.5L14 71l16.3-10zm323.8 172.3l.4 19l18 6.3l-18 6.2l-.4 19l-11.5-15.1l-18.2 5.5l10.8-15.6l-10.8-15.6l18.2 5.5zM37.2 388.1l8 17.2l19-1.6l-13.9 13l7.4 17.5l-16.6-9.1l-14.4 12.4l3.6-18.7L14 409l18.9-2.4zm114.2-249l-6.2 6.2l3.1 47l-3 .3l-5.7-42.9l-5.1 5l7.6 38.4a48 48 0 0 0-17.2 7.1l-21.7-32.4H96l26.4 34.3l-2.4 2l-31.1-35.5h-8.8v8.8l35.4 31l-2 2.5l-34.3-26.3v7.1l32.5 21.7q-5.2 7.8-7.1 17.2L66.3 223l-5.1 5l42.9 5.7q-.3 1.6-.3 3.1l-47-3l-6.2 6.2l6.2 6.2l47-3.1l.3 3.1l-42.9 5.7l5 5l38.4-7.6a48 48 0 0 0 7.1 17.2l-32.5 21.7v7.2l34.3-26.3l2 2.4l-35.4 31v8.8H89l31-35.4l2.5 2L96 312.2h7.2l21.7-32.5q7.8 5.2 17.2 7.1l-7.6 38.4l5 5l5.7-42.9q1.5.3 3.1.3l-3 47l6.1 6.2l6.3-6.2l-3.1-47l3-.3l5.7 43l5.1-5.1l-7.6-38.4a48 48 0 0 0 17.2-7.1l21.7 32.5h7.2l-26.4-34.3l2.4-2l31.1 35.4h8.8v-8.8l-35.4-31l2-2.4l34.3 26.3v-7.2l-32.5-21.7q5.2-7.8 7.1-17.2l38.3 7.6l5.1-5l-42.9-5.7q.3-1.5.3-3.1l47 3l6.2-6.1l-6.2-6.2l-47 3l-.3-3l42.9-5.7l-5-5l-38.4 7.5a48 48 0 0 0-7.1-17.2l32.5-21.7v-7.1l-34.3 26.3l-2-2.4l35.4-31v-8.9H214l-31 35.5l-2.5-2l26.4-34.3h-7.2L178 200.2q-7.8-5.2-17.2-7.1l7.6-38.3l-5-5l-5.7 42.8l-3.1-.3l3-47z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":20},"\u003Cpath fill=\"#bd3d44\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath stroke=\"#fff\" stroke-width=\"37\" d=\"M0 55.3h640M0 129h640M0 203h640M0 277h640M0 351h640M0 425h640\"\u002F>\u003Cpath fill=\"#192f5d\" d=\"M0 0h364.8v258.5H0\"\u002F>\u003Cmarker id=\"SVGEq3dreKJ\" markerHeight=\"30\" markerWidth=\"30\">\u003Cpath fill=\"#fff\" d=\"m14 0l9 27L0 10h28L5 27z\"\u002F>\u003C\u002Fmarker>\u003Cpath fill=\"none\" marker-mid=\"url(#SVGEq3dreKJ)\" d=\"m0 0l16 11h61h61h61h61h60L47 37h61h61h60h61L16 63h61h61h61h61h60L47 89h61h61h60h61L16 115h61h61h61h61h60L47 141h61h61h60h61L16 166h61h61h61h61h60L47 192h61h61h60h61L16 218h61h61h61h61h60z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":22},"\u003Cpath fill=\"#fc0\" d=\"M0 320h640v160H0z\"\u002F>\u003Cpath fill=\"#000001\" d=\"M0 0h640v160H0z\"\u002F>\u003Cpath fill=\"red\" d=\"M0 160h640v160H0z\"\u002F>",{"left":15,"top":15,"width":16,"height":17,"rotate":15,"vFlip":13,"hFlip":13,"body":24},"\u003Cpath fill=\"#ec1b2e\" d=\"M0 0h640v480H0\"\u002F>\u003Cpath id=\"SVG5tfvBPpj\" fill=\"#fff\" d=\"M346.3 103.1C267 98 230.6 201.9 305.6 240.3c-26-22.4-20.6-55.3-10.1-72.4l1.9 1.1c-13.8 23.5-11.2 52.7 11.1 71c-12.7-12.3-9.5-39 12.1-48.9s23.6-39.3 16.4-49.1q-14.7-25.6 9.3-38.9M307.9 164l-4.7 7.4l-1.8-8.6l-8.6-2.3l7.8-4.3l-.6-8.9l6.5 6.1l8.3-3.3l-3.7 8.1l5.6 6.8z\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(72 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(144 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(216 312.5 243.5)\"\u002F>\u003Cuse href=\"#SVG5tfvBPpj\" transform=\"rotate(288 312.5 243.5)\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":27},24,"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0\"\u002F>\u003Cpath d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m12 3l3.35 3.35M9 15l-3.35 3.35m0-12.7L9 9m9.35-3.35L15 9\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":29},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"m4 16l6-7l5 5l5-6\"\u002F>\u003Cpath d=\"M14 14a1 1 0 1 0 2 0a1 1 0 1 0-2 0M9 9a1 1 0 1 0 2 0a1 1 0 1 0-2 0m-6 7a1 1 0 1 0 2 0a1 1 0 1 0-2 0m16-8a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":31},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 5a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm0 10a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1H5a1 1 0 0 1-1-1zm10 0a1 1 0 0 1 1-1h4a1 1 0 0 1 1 1v4a1 1 0 0 1-1 1h-4a1 1 0 0 1-1-1zm0-8h6m-3-3v6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":33},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"m12 3l8 4.5v9L12 21l-8-4.5v-9zm0 9l8-4.5M12 12v9m0-9L4 7.5m12-2.25l-8 4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":35},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M3 12a9 9 0 1 0 18 0a9 9 0 1 0-18 0m9-9v18m0-7l7-7m-7 12l8.5-8.5M12 9l4.5-4.5\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":37},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 12a4 4 0 1 0 8 0a4 4 0 1 0-8 0m-5 0h1m8-9v1m8 8h1m-9 8v1M5.6 5.6l.7.7m12.1-.7l-.7.7m0 11.4l.7.7m-12.1-.7l-.7.7\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":39},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M12 3h.393a7.5 7.5 0 0 0 7.92 12.446A9 9 0 1 1 12 2.992z\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":41},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 6h16M4 12h16M4 18h16\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":43},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M8 7a4 4 0 1 0 8 0a4 4 0 0 0-8 0M6 21v-2a4 4 0 0 1 4-4h4a4 4 0 0 1 4 4v2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":45},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M6 4h11a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a1 1 0 0 1-1-1V5a1 1 0 0 1 1-1m3 0v18m4-14h2m-2 4h2\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":47},"\u003Cpath fill=\"currentColor\" d=\"M16.777 0a2.9 2.9 0 1 1-2.529 4.322H12.91a4.266 4.266 0 0 0-4.265 4.195v2.118a7.08 7.08 0 0 1 4.147-1.42l.118-.002h1.338a2.9 2.9 0 0 1 5.43 1.422a2.9 2.9 0 0 1-5.43 1.422H12.91a4.266 4.266 0 0 0-4.265 4.195v2.319A2.9 2.9 0 0 1 7.222 24A2.9 2.9 0 0 1 5.8 18.57V8.589a7.11 7.11 0 0 1 6.991-7.108l.118-.001h1.338A2.9 2.9 0 0 1 16.778 0M7.223 19.905a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389m9.554-10.464a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.39m0-7.735a1.194 1.194 0 1 0 0 2.389a1.194 1.194 0 0 0 0-2.389\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":49},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M12 3a12 12 0 0 0 8.5 3A12 12 0 0 1 12 21A12 12 0 0 1 3.5 6A12 12 0 0 0 12 3\"\u002F>\u003Cpath d=\"M11 11a1 1 0 1 0 2 0a1 1 0 1 0-2 0m1 1v2.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":51},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M3 21h4L20 8a1.5 1.5 0 0 0-4-4L3 17zM14.5 5.5l4 4\"\u002F>\u003Cpath d=\"M12 8L7 3L3 7l5 5M7 8L5.5 9.5M16 12l5 5l-4 4l-5-5m4 1l-1.5 1.5\"\u002F>\u003C\u002Fg>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":53},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M4 7a2 2 0 0 1 2-2h12a2 2 0 0 1 2 2v12a2 2 0 0 1-2 2H6a2 2 0 0 1-2-2zm12-4v4M8 3v4m-4 4h16m-9 4h1m0 0v3\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":55},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M18 6L6 18M6 6l12 12\"\u002F>",{"slug":57,"title":58,"excerpt":59,"image":60,"publishedAt":61,"topics":62,"readMinutes":69,"html":70,"metaTitle":58,"metaDescription":71,"shareImage":72,"updatedAt":61,"author":76,"related":78},"signal-ringrtc-cve-2026-113380-hang-up-bug","Signal Bug CVE-2026-113380 Could Keep Your Mic Live After You Hang Up","A RingRTC flaw rated CVSS 9.3 let a malicious Signal caller flood the call state machine so your hang-up never landed, keeping the mic and possibly the camera live. It was fixed in RingRTC 2.72.0 on September 4. Here is how to check your app.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fsignal_ringrtc_cve_2026_113380.png","2026-10-23T16:00:00.000+08:00",[63,66],{"key":64,"label":65},"advisories","Advisories",{"key":67,"label":68},"security","Security",4,"\u003Cp>Signal is the app I tell people to use when a conversation actually matters. So this one got my attention: a bug in Signal's calling library meant that tapping the red button did not always end the call. A malicious caller could keep your microphone, and possibly your camera, streaming to them while your screen told you the call was over.\u003C\u002Fp>\u003Cp>It is tracked as \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113380?ref=ghost.jdneer.com\">CVE-2026-113380\u003C\u002Fa>, it carries a CVSS 4.0 score of 9.3 (Critical), and it is already fixed. If your Signal app updates itself, you are almost certainly fine. If you sit on old versions, keep reading.\u003C\u002Fp>\u003Ch2 id=\"what-went-wrong\">What went wrong\u003C\u002Fh2>\u003Cp>Signal's voice and video calls run on \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002Fringrtc?ref=ghost.jdneer.com\">RingRTC\u003C\u002Fa>, its open source calling library built on WebRTC. The \u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113380?ref=ghost.jdneer.com\">NVD entry\u003C\u002Fa> describes the flaw in one line: in RingRTC before 2.72.0, \"a peer that saturates a call's FSM queue can interfere with the ability of a local hangup to tear the call (with its audio and perhaps also video track) down.\" The weakness is classed as CWE-754, an improper check for unusual or exceptional conditions.\u003C\u002Fp>\u003Cp>The researcher's \u003Ca href=\"https:\u002F\u002Fgithub.com\u002FImahian\u002FNotes\u002Ftree\u002Fmain\u002Fdocs\u002FCVEs\u002FCVE-2026-113380?ref=ghost.jdneer.com\">GitHub write-up\u003C\u002Fa> explains it plainly. Your hang-up was not a kill switch. It was just one more event placed at the back of the call's finite state machine (FSM) event queue, and according to the write-up there was no rate limit on events coming from the other side and no priority lane for hang-up. The write-up's own summary: \"Flood the queue with junk and the hang-up waits behind attacker noise forever, so the call (microphone, possibly camera) is never torn down.\"\u003C\u002Fp>\u003Cp>That is a design lesson I would hand to anyone writing networked software: a control action the local user takes should never wait in line behind input from an untrusted peer.\u003C\u002Fp>\u003Ch2 id=\"the-fix-and-the-timeline\">The fix and the timeline\u003C\u002Fh2>\u003Cul>\u003Cli>\u003Cstrong>September 4, 2026:\u003C\u002Fstrong> Signal committed \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002Fringrtc\u002Fcommit\u002F4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3?ref=ghost.jdneer.com\">\"Ensure calls terminate completely in corner cases\"\u003C\u002Fa> to RingRTC and tagged version 2.72.0 the same day. The \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002Fringrtc\u002Fblob\u002Fmain\u002FCHANGELOG.md?ref=ghost.jdneer.com\">RingRTC changelog\u003C\u002Fa> lists that line under v2.72.0, with no mention of security. The \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002Fringrtc\u002Fcompare\u002Fv2.71.0...v2.72.0?ref=ghost.jdneer.com\">v2.71.0 to v2.72.0 comparison\u003C\u002Fa> is the second reference in the CVE record.\u003C\u002Fli>\u003Cli>\u003Cstrong>October 20, 2026:\u003C\u002Fstrong> the \u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-113380&ref=ghost.jdneer.com\">CVE record\u003C\u002Fa> was published by MITRE, NVD added it, and the researcher published the write-up with a proof of concept.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>So the fix shipped about six weeks before anyone talked about the bug publicly. That is how it should work.\u003C\u002Fp>\u003Ch2 id=\"how-bad-is-it-really\">How bad is it really?\u003C\u002Fh2>\u003Cp>The score is high, and the impact is real: someone hears you after you believe the call has ended. But keep it in proportion. The attacker has to be on a call with you first, which means you picked up or placed that call. CISA's enrichment on the CVE record lists exploitation as \"none,\" and I found no report of this being used in the wild.\u003C\u002Fp>\u003Cp>The proof of concept is conceptual. The researcher's \u003Ccode>poc.py\u003C\u002Fcode> is, in their words, \"purely synthetic, offline, no network, no real calls, no exploit.\" It models a queue being flooded so a hang-up event is buried, next to a fixed version where hang-up jumps the line. It shows the pattern, not a working attack on Signal.\u003C\u002Fp>\u003Cp>The 9.3 also comes from the CVE record itself (CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:H\u002FSI:N\u002FSA:N). NVD lists its status as \"Awaiting Analysis,\" so NIST has not published its own score yet.\u003C\u002Fp>\u003Ch2 id=\"are-you-affected\">Are you affected?\u003C\u002Fh2>\u003Cp>You are affected if your Signal app bundles a RingRTC build older than 2.72.0. Signal does not print the RingRTC version in the app, so check the app version and compare it with the first releases that pull in 2.72.0 according to Signal's public source repositories (\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002FSignal-Android\u002Fblob\u002Fv8.27.0\u002Fgradle\u002Flibs.versions.toml?ref=ghost.jdneer.com\">Android\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002FSignal-iOS\u002Fblob\u002F8.30.0.1869-beta\u002FPodfile?ref=ghost.jdneer.com\">iOS\u003C\u002Fa>, \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002FSignal-Desktop\u002Fblob\u002Fv8.29.0\u002Fpackage.json?ref=ghost.jdneer.com\">Desktop\u003C\u002Fa>):\u003C\u002Fp>\n\n\u003Ctable>\u003Cthead>\u003Ctr>\u003Cth>Platform\u003C\u002Fth>\u003Cth>First app version with RingRTC 2.72.0 in source\u003C\u002Fth>\u003Cth>Where to see your version\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd>Android\u003C\u002Ftd>\u003Ctd>8.27.0\u003C\u002Ftd>\u003Ctd>Signal: profile picture > Help (version shown at the top), or Android Settings > Apps > Signal\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>iOS\u003C\u002Ftd>\u003Ctd>8.30\u003C\u002Ftd>\u003Ctd>Signal: Settings > Help (version shown near the bottom), or App Store > Signal\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>Desktop\u003C\u002Ftd>\u003Ctd>8.29.0\u003C\u002Ftd>\u003Ctd>Signal Desktop: Help > About Signal Desktop (on macOS: Signal > About Signal)\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\n\n\u003Cul>\u003Cli>\u003Cstrong>Check your version.\u003C\u002Fstrong> Use the paths above. Release tags in the repositories do not always match the exact day a version hits the store, so treat these numbers as a floor, not a guarantee.\u003C\u002Fli>\u003Cli>\u003Cstrong>Just update.\u003C\u002Fstrong> If you are unsure, install the latest Signal from Google Play, the App Store, or signal.org. Current releases include the fix.\u003C\u002Fli>\u003Cli>\u003Cstrong>Managed devices.\u003C\u002Fstrong> If you run a fleet with pinned app versions, look for Signal builds older than the versions above in your MDM inventory and push the update.\u003C\u002Fli>\u003Cli>\u003Cstrong>Until you have updated:\u003C\u002Fstrong> after hanging up, check that the call indicator and the system mic and camera indicators are gone before you talk about anything sensitive. If in doubt, force close the app.\u003C\u002Fli>\u003C\u002Ful>\u003Cp>\u003Cstrong>On Linux Desktop (Debian or Ubuntu package):\u003C\u002Fstrong> check the installed package version:\u003C\u002Fp>\u003Cpre>\u003Ccode>dpkg -s signal-desktop | grep '^Version'\u003C\u002Fcode>\u003C\u002Fpre>\u003Cp>Anything at 8.29.0 or later bundles the fix. Update with:\u003C\u002Fp>\u003Cpre>\u003Ccode>sudo apt update && sudo apt install --only-upgrade signal-desktop\u003C\u002Fcode>\u003C\u002Fpre>\u003Ch2 id=\"my-take\">My take\u003C\u002Fh2>\u003Cp>This is not a reason to drop Signal. The fix was quiet, early, and open for anyone to read in the commit history. It is a reason to keep auto-updates on, and a reminder that \"the call ended\" is something your software claims, not something you should take on faith.\u003C\u002Fp>\u003Cp>\u003Cem>Sources: \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-113380?ref=ghost.jdneer.com\">\u003Cem>NVD CVE-2026-113380\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-113380&ref=ghost.jdneer.com\">\u003Cem>CVE record\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002FImahian\u002FNotes\u002Ftree\u002Fmain\u002Fdocs\u002FCVEs\u002FCVE-2026-113380?ref=ghost.jdneer.com\">\u003Cem>researcher write-up and PoC\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002Fringrtc\u002Fcommit\u002F4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3?ref=ghost.jdneer.com\">\u003Cem>RingRTC fix commit\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002Fringrtc\u002Fblob\u002Fmain\u002FCHANGELOG.md?ref=ghost.jdneer.com\">\u003Cem>RingRTC changelog\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, Signal \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002FSignal-Android\u002Fblob\u002Fv8.27.0\u002Fgradle\u002Flibs.versions.toml?ref=ghost.jdneer.com\">\u003Cem>Android\u003C\u002Fem>\u003C\u002Fa>\u003Cem>, \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002FSignal-iOS\u002Fblob\u002F8.30.0.1869-beta\u002FPodfile?ref=ghost.jdneer.com\">\u003Cem>iOS\u003C\u002Fem>\u003C\u002Fa>\u003Cem> and \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fsignalapp\u002FSignal-Desktop\u002Fblob\u002Fv8.29.0\u002Fpackage.json?ref=ghost.jdneer.com\">\u003Cem>Desktop\u003C\u002Fem>\u003C\u002Fa>\u003Cem> source. First reported by \u003C\u002Fem>\u003Ca href=\"https:\u002F\u002Fwww.securityweek.com\u002Fsignal-vulnerability-lets-malicious-callers-block-hang-ups\u002F?ref=ghost.jdneer.com\">\u003Cem>SecurityWeek\u003C\u002Fem>\u003C\u002Fa>\u003Cem>.\u003C\u002Fem>\u003C\u002Fp>","A RingRTC flaw rated CVSS 9.3 let a malicious Signal caller flood the call state machine so your hang-up never landed, keeping the mic and possibly the...",{"src":60,"width":73,"height":74,"type":75},1600,900,"image\u002Fpng",{"name":77,"url":10,"owner":5},"JD Bungart",[79,89,100,111],{"slug":80,"title":81,"excerpt":82,"image":83,"publishedAt":84,"topics":85,"readMinutes":88},"http2shell-cve-2026-111497-brotli-decoder","HTTP2Shell (CVE-2026-111497): What the Brotli Decoder Bug Really Hits, and How to Patch","CVE-2026-111497 is an out-of-bounds write in Google's Brotli decoder, 1.0.3 through 1.2.0. Fixed in 1.0.10, 1.1.1 and 1.2.1, plus Node.js, Bun, Python, Envoy and .NET updates. You are exposed if you decode untrusted Brotli data. Not in CISA KEV.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fhttp2shell_cve_2026_111497_v2.png","2026-10-26T20:51:27.000+08:00",[86,87],{"key":64,"label":65},{"key":67,"label":68},1,{"slug":90,"title":91,"excerpt":92,"image":93,"publishedAt":94,"topics":95,"readMinutes":88},"package-cooldowns-github-package-firewall-npm-pnpm-bun-pip-uv-poetry","Package Cooldowns Compared: GitHub Package Firewall vs. What npm, pnpm, Yarn, Bun, pip, uv and Poetry Already Do","GitHub now offers an install-time firewall for npm, free in preview and metered later. Most package managers already ship a free cooldown. Here is what each tool does, the copy-paste config, and where cooldowns stop helping.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Fpkg-cooldowns-conveyor-alberto-rodriguez-unsplash.jpg","2026-10-26T14:00:00.000+08:00",[96,99],{"key":97,"label":98},"guides","Guides",{"key":67,"label":68},{"slug":101,"title":102,"excerpt":103,"image":104,"publishedAt":105,"topics":106,"readMinutes":88},"tailscale-ssh-tailworm-mesh-vpn-agent-risk","Your Mesh VPN Agent Is Root on Every Box. Tailworm Is the Reminder.","A researcher showed one hacked Tailscale node reaching root on other servers through Tailscale SSH forwarding. No patch yet. Here is why mesh VPN agents deserve the same suspicion as any privileged daemon.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Ftailworm-padlock-light-trails-flyd-unsplash.jpg","2026-10-26T12:00:00.000+08:00",[107,110],{"key":108,"label":109},"opinion","Opinion",{"key":67,"label":68},{"slug":112,"title":113,"excerpt":114,"image":115,"publishedAt":116,"topics":117,"readMinutes":88},"emudhra-ca-weak-keys-chain-of-trust","eMudhra Broke Almost Nothing, and Still Dented the Chain of Trust","Eight eMudhra intermediate CA keys turned out to be numbers under 256. Browsers blocked them within hours, almost no site broke, and eMudhra is leaving the TLS business. The service impact was tiny. The lesson for the chain of trust is not.","\u002Fcontent\u002Fimages\u002F2026\u002F10\u002Femudhra-keys-iolandino-baiano-unsplash.jpg","2026-10-25T16:00:00.000+08:00",[118,119],{"key":108,"label":109},{"key":67,"label":68},{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":121},"\u003Cpath fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\" d=\"M5 12h14M5 12l6 6m-6-6l6-6\"\u002F>",{"left":15,"top":15,"width":26,"height":26,"rotate":15,"vFlip":13,"hFlip":13,"body":123},"\u003Cg fill=\"none\" stroke=\"currentColor\" stroke-linecap=\"round\" stroke-linejoin=\"round\" stroke-width=\"2\">\u003Cpath d=\"M6.5 7.5a1 1 0 1 0 2 0a1 1 0 1 0-2 0\"\u002F>\u003Cpath d=\"M3 6v5.172a2 2 0 0 0 .586 1.414l7.71 7.71a2.41 2.41 0 0 0 3.408 0l5.592-5.592a2.41 2.41 0 0 0 0-3.408l-7.71-7.71A2 2 0 0 0 11.172 3H6a3 3 0 0 0-3 3\"\u002F>\u003C\u002Fg>"]