CVE-2026-113380 Signal RingRTC vulnerability exposure post-call. Critical Signal vulnerability CVE-2026-113380 leaves mic and camera active after hangup in RingRTC versions before 2.72.0. Update immediately to protect. Signal's recent disclosure of CVE-2026-113380 reveals a significant security flaw within its RingRTC library that impacts call termination processes. This vulnerability allows malicious call participants to keep audio, and potentially video, streaming even after a user hangs up, presenting substantial privacy risks for sensitive communications. How CVE-2026-113380 exploits call termination. At the core of the issue is a finite-state machine (FSM) event queue within RingRTC versions before 2.72.0. An attacker can saturate this event queue during a call, effectively blocking or deprioritizing the call termination event. As a result, the call does not fully end on the victim's device, leaving microphones and cameras active despite the apparent hangup. Exploitation requires the attacker to be an active participant in the call, making remote activation without presence impossible. However, the complexity of this attack is low given the ease of queue saturation, and the critical CVSS score of 9.3 underscores the severe confidentiality impact. Implications for Signal users and security teams. This vulnerability focuses on unauthorized audio/video interception post-call termination, exposing users to privacy infringements even after disconnecting. Since calls commonly involve personal, financial, or confidential conversations, the lingering access to microphone and camera streams could facilitate eavesdropping or unauthorized data capture. The cross-platform nature of RingRTC means Android, iOS, and desktop Signal clients using vulnerable library versions are at risk. While no active exploitation has been reported in the wild, the low attack barrier urges immediate updating. The path to mitigation and future considerations. Signal addressed this critical flaw in RingRTC version 2.72.0 by implementing independent termination flags coupled with limits on shutdown wait times. These changes enhance call teardown robustness and prevent daemon queuing bottlenecks that permitted call termination suppression. Security professionals must prioritize patching Signal clients and dependencies swiftly. Moreover, this incident highlights the importance of monitoring internal event queue handling within VoIP and real-time communication libraries, as attackers increasingly target such subtleties to bypass security controls. Regular code audits for FSM implementations and fail-safes can mitigate similar queuing vulnerabilities. Transparency from Signal in communicating affected client versions will support organizational risk management and compliance efforts. Conclusion CVE-2026-113380 represents a sophisticated exploitation of call lifecycle management in Signal's RingRTC library, threatening user privacy with prolonged audio/video exposure. Though exploitation requires call participation, the low complexity and critical severity necessitate rapid patch adoption. For cybersecurity professionals, this vulnerability is a stark reminder of the nuanced challenges in securing real-time communication software. Continuous vigilance, comprehensive testing, and swift remediation remain key to defending sensitive voice and video communications from emerging attack vectors.

Signal adds encypted local backup support to iOS, desktop apps. By GIXnews / September 29, 2026 Signal, the secure messaging app, released version 8.30, completing the rollout of its secure backups feature across all supported operating systems (Android, iOS, Linux, macOS, and Windows). [...]

Back to backups: A year in review. jimio on 28 Sep 2026 Last September, Signal Group introduced an optional new way to automatically keep your Signal data safely and securely backed up so that important messages and memories can be easily recovered if something unexpected happens to one of your devices. Signal Group has been listening to your feedback and working hard on several improvements over the past year. Signal Group hinted at several of these "future plans" when Signal Secure Backups were first announced, and the future is now available on all platforms with the launch of iOS version 8.30 today. Here's an overview of everything that's changed since the initial release. Backing up to a destination of your choice. Available on Signal Desktop and Signal iOS for the first time, and fully revamped on Signal Android, on-device backups provide another way to preserve an end-to-end encrypted copy of your Signal messages. On-device backups have been available on Android for many years, but they now utilize the same cross-platform format that's supported by Signal Desktop and Signal iOS, and they incorporate additional improvements as well. Previously, the local Signal Android backups included everything in a single archive, so daily snapshots took up a lot of extra space. Now backup media gets stored in a separate folder so it's easier to periodically sync, and duplicate files are only stored once, which also helps save space if you decide to mirror an on-device backup to an external hard drive or NAS server on your home network. Cross-platform support. Now you can bring your Signal chats with you when you get a new device, even if you decide to switch to a completely different platform. Signal Secure Backups and on-device backups can be created and restored across every supported operating system: Android, iOS, Linux, macOS, and Windows. Storage optimization. Make room for new memories by automatically optimizing storage space and offloading older photos and videos. When this feature is enabled, a small thumbnail remains saved on your device in place of the original file. The full-size copy remains securely stored in your paid backup account, and it can be seamlessly retrieved and displayed when you tap on that attachment. Offloading unused media can significantly reduce the amount of storage space that Signal is using. For example, 5,120 megabytes (a.k.a. 5GB) of unused media becomes approximately 600 megabytes after enabling the Optimize Signal Storage setting, leaving you with a lot more room to receive new images and videos. Attachment backfill for linked devices. For a small monthly fee that helps cover storage costs for end-to-end encrypted attachments, up to 100 gigabytes of media can be backed up with a paid Signal Secure Backups plan. The free plan still lets you keep your text messages backed up, but only covers the last 45 days of media. Attachment backfill can help bridge this gap by synchronizing media and attachments across linked devices. For instance, if you open a message thread on a newly linked laptop and scroll beyond the 45-day limit, Signal Desktop can now securely request a copy of any missing files directly from your primary device as an end-to-end encrypted attachment. You could always forward yourself one of your own messages too, but this simplifies the process by automatically restoring attachments and media from your primary device with a single tap. Some constraints and optimizations. With every new feature idea comes the reality of building performant, robust software that runs reliably and efficiently on millions of devices. Signal Group made a few decisions in the process of building these new backup features that might not be exactly what Signal Group'd like in a magical world where the bytes and bandwidth are free and software systems never fail. Some may see these as limitations; Signal Group see them as trade-offs necessary for a real-world deployment. Signal Secure Backups. * For the sake of efficiency, very long messages are sent as text attachments. Individual messages up to 128 kilobytes (approximately 1/4 of an average book) can be backed up for free, but larger messages are subject to the same 45-day limit for media attachments on free accounts. * In order to conserve upload bandwidth on mobile connections, your Signal client only needs to back up a single encrypted copy of a given attachment even if you receive multiple copies of the same file. As an additional optimization, when you enable a paid backup account for the first time, existing end-to-end encrypted attachments within the 45-day download expiration window can be transferred to your new paid backup account without having to be uploaded again. * Attachments are never de-duplicated across accounts and they are always end-to-end encrypted, but specialized users with unique requirements can choose to utilize on-device backups and synchronize files to their own server for uncommon use cases where copying end-to-end encrypted attachments and performing basic per-user de-duplication on end-to-end encrypted attachments are considered relevant metadata. * The hosted Signal Secure Backups service implements another layer of security using a supplemental cryptographic key that rotates daily. This key is securely stored in a Trusted Execution Environment, and it cannot decrypt any backups without your recovery key, which provides the primary layer of end-to-end encryption. * The sole purpose of this additional key is to add a layer of forward secrecy to your end-to-end encrypted backups. Signal clients also use remote attestation to ensure and verify that the old key is discarded every time it is replaced. Trusted Execution Environments are currently the best way to protect this supplemental key, but this may change in the future as additional research and improvements occur in this space. On-device backups. * With Signal Secure Backups, your phone can request that the server securely copy recent end-to-end encrypted attachments from ephemeral storage to get a head start on backing up the last 45 days of media. * For an on-device backup, everything needs to be copied from scratch, and this may result in using more bandwidth or disk space depending on your chosen storage location. * Unlike Signal Secure Backups on a paid/free plan, given the need to support any generic storage layer (a personal drive, a NAS server in your house, third-party storage services, etc.), on-device backups cannot utilize the same Trusted Execution Environment described above to provide forward secrecy. * Your on-device backup recovery key can decrypt all past backups wherever they are stored, instead of only the most-recent backup. * For example, if you're storing backups on a USB drive, you may want to periodically delete previous backups. As always, it's important to keep your recovery key safe and never share it with anyone. Signal Android and Signal iOS can also integrate with the password manager of your choice to store this information. * Signal Secure Backups and on-device backups in Signal currently exclude disappearing messages that are scheduled to vanish within 24 hours. * When you use the hosted Signal Secure Backups service Signal Group provide, a new backup is created every 24 hours and the previous backup is automatically removed. However, on-device backups work differently, and the storage layer is separate from the on-device backup process so this cannot be automated in the same way. * Expired disappearing messages in an on-device backup are automatically skipped during the transfer process when you restore that backup, but you may want to take additional steps such as setting a shorter expiration timer for disappearing messages in on-device backups. Thank you, next. Also available in the latest iOS release, and just in time for your next upgrade, the revamped device-to-device migration experience makes it easier than ever to securely transfer your Signal information from an old iPhone to a new iPhone over a local end-to-end encrypted wireless link using Wi-Fi Aware networking for dramatically improved speed and reliability too. Whether or not you choose to subscribe to a paid backup plan, Signal Group hope these features give you more control over how to manage and preserve your Signal data while providing new options for keeping your messages safe. This wraps up the first phase of the backups project, but Signal Group is hard at work on several non-backup improvements too. Signal Group'd like to express its sincere appreciation for everyone who gave Signal Group valuable feedback throughout this process, especially those of you who helped Signal Group test new functionality and ideas during the beta period