What is a zero-day vulnerability?

A zero-day is a security flaw unknown to the software vendor — they have had zero days to patch it. Attackers exploit them freely until the vendor learns about the issue and releases a fix. Nation-state groups actively trade zero-days for hundreds of thousands of dollars.

Should I install software updates immediately?

Yes, especially for critical patches. Most real-world attacks exploit known vulnerabilities that already have patches. Enable automatic updates for your OS, browser, and security software. Wait 24-48 hours for major updates if concerned about first-day bugs, then install.

What is CVE and why does it matter?

CVE (Common Vulnerabilities and Exposures) assigns a unique ID to each documented flaw. Each CVE has a CVSS severity score from 0 to 10 — anything 9.0+ is critical. When a patch is released for a CVE, it means attackers know the details and exploitation attempts increase immediately.

A Signal Bug Could Keep Your Mic On After You Hang Up

When "Call Ended" Didn't Actually End the Call

You hung up. The screen went dark. But on the other end, the call kept going.

That is not a hypothetical. A critical flaw in Signal's calling library let a malicious caller prevent your device from fully ending a call. Your microphone, and possibly your camera, could stay active after you thought the call was over. Nothing on your screen would tell you.

Signal has fixed it. If you have not updated yet, do that before your next call.

How Did This Actually Work?

Signal's calling library, called RingRTC, manages the real-time mechanics of every call: connecting, audio routing, and tearing down cleanly when you hang up. It processes actions through an internal event queue. That queue holds 256 slots.

The attack works by flooding that queue. A caller sends enough events to fill all 256 slots before your hangup action can get through. When the queue is saturated, the cleanup sequence stalls. The call does not end. The streams stay open. Your microphone keeps transmitting.

This required no access to your device, your account, or your contacts. Anyone on the other end of any call could trigger it.

The Numbers

CVE-2026-113380. CVSS 9.3 out of 10. MITRE disclosed the vulnerability on October 20, 2026.

The flaw affects Signal on every platform: Android, iOS, and desktop. Any version running RingRTC below 2.72.0 was vulnerable.

A proof-of-concept has been published publicly. That means the method is documented and replicable. No confirmed exploitation in the wild has been reported yet, but a public proof-of-concept shortens the window between "disclosed" and "actively used." That window closes the moment you update.

Signal patched the flaw in RingRTC 2.72.0. The fix adds a separate termination flag that operates independently of the event queue, plus a five-second shutdown timeout. Even if the queue is completely saturated, the call still gets killed. The cleanup completes. The mic goes silent.

What You Need to Do Right Now

Update Signal on every device you use for calls. Not just your phone. If you use Signal on a tablet or desktop, update those too. The vulnerability exists across all platforms.
Check your current version. Open Signal, go to Settings, then Help (on mobile) or About (on desktop). You want a build that packages RingRTC 2.72.0 or later. If you are unsure, update anyway.
Enable automatic updates. For Signal specifically, and for your apps generally. Patches like this ship quietly and get missed when updates are manual.
Tell the people you call. If you use Signal for sensitive conversations, the update only protects you if the people you call are protected too.

Should You Be Worried About Past Calls?

That depends on what you discussed and who might want to hear it. No confirmed exploitation means there is no evidence this was used against real targets. But the bug existed before the October 20 disclosure, and you cannot know for certain whether someone used it before that.

If you have had sensitive calls on Signal recently and you have reason to believe someone would want to monitor them, flag that concern to a security professional. For most people, the right move is simpler: update now, move forward.

The Problem a Single Update Cannot Solve

Signal earns its reputation. End-to-end encryption, minimal metadata retention, open-source code that security researchers can actually read and audit. That last piece is how this bug got caught and disclosed responsibly before it could be weaponized at scale.

But "trustworthy" and "flawless" are not the same thing. No software running at this complexity is immune to bugs. The distance between "secure by design" and "secure on the device in your pocket right now" is where real risk lives. It is a distance measured in pending updates.

Signal's infrastructure did not get breached here. No database was exposed. No mass surveillance became possible. This was a targeted attack surface: one caller, one call, one device. Targeted is exactly what matters if you are a journalist protecting a source, a founder discussing an acquisition, or an activist coordinating in a country where that carries real risk.

The good news is that the fix is free, it is already shipped, and it takes thirty seconds.

Do this now:

Open Signal and update on your phone, tablet, and desktop
Turn on automatic app updates if you have not already
Tell the colleagues and contacts you call on Signal to do the same

The patch exists. The only variable is whether it is on your device yet.