At a glance
- What it is: an eight-byte message that can crash an unpatched Android phone’s calling and messaging service, with no click and no visible sign.
- Our view: the bigger issue is not the handset. It is the messaging chain that banks and businesses rely on for one-time passwords and alerts.
- Our advice: patch and find the phones that cannot be patched, put SMS in the risk register, and test what your messaging chain will accept.
Most security advice about text messages is about what people click. The Android flaw now known as the “SMS of Death” needs no click at all, which is why we think it deserves attention well beyond the people whose phones are affected.
Wajahat Gondal, our Head of Risk Technology Development, sets out the wider concern:
“The recently disclosed Android “SMS of Death” vulnerability highlights a security risk that extends well beyond individual mobile devices.”
What happened, briefly
On 31 October 2026, BleepingComputer reported that a security researcher, Mark Blah, had published a working proof of concept for the flaw. It sits in the part of Android that reads WAP Push messages, a type of binary message phones handle in the background.
A malformed eight-byte message makes that code fail, which crashes the process that runs calls, texts and the mobile connection. Calls drop, including emergency calls, and because Android processes the message before it reaches the inbox, the owner sees nothing.
In the researcher’s testing, 20 messages could put phones into a reboot loop, and one Android 12 device needed a factory reset. Google fixed Android 14 to 17 in its October 2026 updates, but Android 12 and 13 have no reported fix.
Why we think it matters
Wajahat’s first point is that a zero-click flaw sidesteps the defences most organisations have built:
“This is an important distinction because traditional SMS security measures and user awareness programmes are primarily designed around malicious links, phishing messages and fraudulent content. A vulnerability that operates at the protocol-processing level challenges those assumptions entirely.”
His second is about who depends on SMS. Banks, government bodies, healthcare providers and large firms use it for one-time passwords, transaction alerts and customer checks, so:
“A messaging-related vulnerability or abuse scenario can therefore extend beyond individual subscribers and potentially affect service availability, authentication workflows, customer trust and business continuity.”
There is also an investigator’s angle. A phone that cannot take a call or receive a text, even for a short time, is useful to someone attempting fraud. The bank’s warning text or verification call is exactly what they would want to stop.
The reporting we have seen does not describe any real attacks of this kind, so this is our reasoning rather than a known case. But it shows why a “crash” is worth more thought than its label suggests.
What we advise
1. Patch, then find the phones that cannot be patched
Any Android phone with a security patch level earlier than October 2026 should be treated as exposed. Wajahat’s advice reaches past the patch itself:
“At the subscriber level, organisations should evaluate Android device patching, mobile device management, endpoint visibility and the risks associated with deploying unsupported operating system versions across large device fleets.”
Our practical step: list the company phones still on Android 12 or 13, starting with those held by executives and staff who approve payments.
2. Put SMS in the risk register
Most firms treat text messages as a utility. Wajahat’s view is that they are a dependency:
“Organisations relying on SMS-based authentication should also recognise that the availability and integrity of the underlying mobile messaging ecosystem are dependencies that need to be included in their security risk assessments.”
Try this exercise: ask what would happen if customers’ one-time passwords stopped arriving for an hour. If there is no fallback, such as app-based approval, that is the gap to close.
3. Ask what your messaging chain will accept
Text messages pass through gateways, message centres, interconnects and outside providers before they reach anyone. Wajahat argues that these systems need testing for more than uptime:
“These systems must be assessed not only for availability and operational performance but also for their ability to handle malformed, unexpected or potentially malicious messaging traffic.”
SMS firewalls help, but Wajahat is clear about their limits: filtering, rate limiting and traffic monitoring “can help reduce exposure, although they should not be assumed to detect or block every malformed payload”.
4. Question every trusted connection
Messages often arrive through aggregators and long-standing connections, which makes them easy to trust by default. Wajahat warns against exactly that:
“Security teams should not simply assume that traffic reaching their messaging infrastructure is trustworthy because it originates from an established aggregator or authorised connection.”
The standard to aim for: “Every interface, integration and trust relationship should have appropriate access restrictions, monitoring, validation and security controls.”
5. Agree who owns which layer
No single party can fix this alone. Manufacturers patch the handset, operators secure the network, firewall vendors filter traffic, and businesses decide how much they rely on SMS. In Wajahat’s words:
“The responsibility for mobile messaging security cannot sit with a single technology layer.”
Our practical step: ask your SMS provider what it filters, how it handles binary messages, and what it would tell you if something unusual came through.
6. Test the controls, not just the list
Having a firewall and a patch policy is not the same as knowing they work. Wajahat’s point is that testing must go further than a conventional scan:
“Equally important is validating whether existing security controls actually perform as expected when exposed to abnormal traffic and unexpected protocol behaviour.”
This is how we approach testing. Our Vulnerability Assessment & Penetration Testing engagements begin with what an attacker could learn from the outside, drawing on our background in intelligence and investigations. An Advanced engagement links weaknesses together and follows realistic attack paths, under signed Rules of Engagement.
The weakest link
Wajahat’s conclusion applies to any chain of trust, not only to text messages:
“Ultimately, the “SMS of Death” vulnerability is a reminder that telecommunications security is only as strong as the weakest component in the messaging chain.”
If you would like to explore where the weak points sit in your own organisation, we are glad to have a confidential conversation.
Based on public reporting as at 8 November 2026. Details of affected versions and patches may change as manufacturers release updates.
