Cybersecurity News Everyday
@TweetThreatNews
CVE-2026-113380 affects RingRTC versions before 2.72.0 and could let a call participant keep hearing audio after hang-up. No in-the-wild exploitation is known; users are advised to update Signal.
// tag
iOS
Security incidents tagged iOS. Newest first.
- incidents
- 4
- live
- 1
- patched
- 4
## 4 iOS incidents in the last year
through Oct 22, 2026crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore
- criticallivepatchedsince Oct 20, 2026
Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
› Signal (RingRTC calling library, @signalapp/ringrtc)
A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.
CVE-2026-113380 highApple CoreGraphics zero-day CVE-2026-86950patched
› Apple iOS, iPadOS, macOS (CoreGraphics) patched
Apple patched CVE-2026-86950, an out-of-bounds write in CoreGraphics that may lead to arbitrary code execution, and indicated it may have been exploited in a sophisticated targeted attack against earlier iOS versions. Fixed in iOS/iPadOS 26.7.1 and corresponding macOS updates. CISA added to KEV Sept 29.
open incident →CVE-2026-86950
show 2 older incidents2 older incidents
March 2026 1
highApple Multiple Products: Apple Multiple Products Improper Locking Vulnerabilitypatched
› Apple Multiple Products patched
Apple watchOS, iOS, iPadOS, macOS, visionOS, and tvOS contain an improper locking vulnerability that could allow a malicious application to cause unexpected changes in memory shared between processes. CISA added CVE-2025-43510, CVE-2025-43520, CVE-2025-31277 to the Known Exploited Vulnerabilities catalog on 2026-03-20 based on evidence of active exploitation.
open incident →CVE-2025-43510 · CVE-2025-43520 · CVE-2025-31277
February 2026 1
highApple Multiple Products: Apple Multiple Buffer Overflow Vulnerabilitypatched
› Apple Multiple Products patched
Apple iOS, macOS, tvOS, watchOS, and visionOS contain an improper restriction of operations within the bounds of a memory buffer vulnerability that could allow an attacker with memory write the capability to execute arbitrary code. Added to CISA KEV on 2026-02-12.
open incident →CVE-2026-20700
## posts 2
- › Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
- › Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
tsn_hub@tsnmediahub📵 Update Signal. A critical flaw in its RingRTC calling library could stop a call ending when you hang up, leaving audio and perhaps video running, per its CVE record. RingRTC 2.72.0 fixes it. There's no report of exploitation. Source: CVE-2026-113380 record
