Signal clone used by federal agencies hit in attacks targeting major flaws - CISA says patch immediately

News
By published

Federal messaging app hit by hackers

Person with warning notification and spam message icon on mobile phone
(Image credit: Shutterstock)
  • Hackers are actively targeting a messaging app used by federal agencies
  • The app was also involved in the Signalgate scandal
  • Hackers have already stolen chats and metadata from 60 government officials

The US Cybersecurity and Infrastructure Security Agency (CISA) has warned a popular Signal messaging app clone being used by federal agencies is under attack.

The clone, TeleMessage, was found to have some serious issues, including a lack of proper end-to-end encryption.

Hackers have been exploiting two flaws, CVE-2025-48927 and CVE-2025-48928, to access federal chat logs and metadata. CISA has given federal agencies until July 22 to apply patches.

Latest Videos From

Federal chat app hacked

The new comes months after then-US national security advisor Mike Waltz accidentally added Jeffrey Goldberg, editor in chief at The Atlantic, to a secret Signal chat discussing ongoing US strikes against Houthi rebels in Yemen. Waltz was then removed from his position as a result.

Following investigations into the fiasco, it emerged that Waltz and others weren’t using Signal, but a clone of the app called TM SGNL, which was developed by TeleMessage.

The app was then subsequently targeted in an attack that saw the chat logs and metadata of around 60 government officials including Secret Service members and a White House official leaked online.

The first flaw listed by CISA, CVE-2025-48927, has a CVSS score of 5.3, and allows hackers to extract sensitive data from memory dumps exposed by a Spring Boot Actuator misconfiguration in the TeleMessage app that exposes the /heapdump endpoint.

The second flaw, CVE-2025-48928, has a CVSS score of 4.0, and allows an attacker to access exposed passwords sent over HTTP by stealing a memory-dump file through local access to the TeleMessage server.

No other details on the flaws have been released by CISA, but the agency has said that federal agencies must patch the app by July 22 or stop using it altogether.

Via The Register

You might also like

Benedict Collins
Benedict Collins
Senior Writer, Security

Benedict is a Senior Security Writer at TechRadar Pro, where he has specialized in covering the intersection of geopolitics, cyber-warfare, and business security.

Benedict provides detailed analysis on state-sponsored threat actors, APT groups, and the protection of critical national infrastructure, with his reporting bridging the gap between technical threat intelligence and B2B security strategy.

Benedict holds an MA (Distinction) in Security, Intelligence, and Diplomacy from the University of Buckingham Centre for Security and Intelligence Studies (BUCSIS), with his specialization providing him with a robust academic framework for deconstructing complex international conflicts and intelligence operations, and the ability to translate intricate security data into actionable insights.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.