Security researcher Evan Connelly discovered an enormous flaw affecting one of the largest telecommunications companies in the world that could allow any single person to view the recent incoming call log for potentially any Verizon phone number.
A vulnerability in the Verizon Call Filter iOS app allowed anyone to request the call logs of millions of US Verizon customers. The Verizon Call Filter app for iOS allows customers to view a log of their recent calls. This log will show them the phone numbers and an associated timestamp. To request such a log the app sends a request to a server to fetch the data belonging to the phone number in question. The network request to the server contains various details such as your phone number and the requested time period for call records. The server then responds with a list of calls and timestamps.
Read more…
Source: Malwarebytes Labs
Sign up for our Newsletter
The latest news and insights delivered right to your inbox.
Related:
- Shipping giant Maersk confirms data breach as hackers demand $5 million ransom
November 12, 2026
One of the world’s largest shipping and logistics companies, A.P. Moller–Maersk (often just called Maersk) has confirmed it recently suffered a cyberattack in which it lost sensitive data from one of its earlier acquisitions. The criminals are now trying to pressure the company into paying a ransom, threatening to release all of the stolen information on ...
- Attackers use Autonomous AI to target semiconductor, defense and civil society sectors
November 12, 2026
From August–September 2026, Chinese-speaking attackers used an open-source AI penetration testing framework called Cairn to autonomously conduct 25 operations against at least 19 organizations. The attackers weaponized Cairn by pairing it with Chinese AI models Zhipu GLM and DeepSeek. The attackers supplied a target and a goal, then Cairn planned, executed and recorded results on its ...
- Hackers exploiting ScreenConnect plugin flaw to spread malware across hundreds of PCs
November 12, 2026
Hackers have used a dodgy third-party ScreenConnect extension to push malware onto at least 288 machines across 48 organizations, prompting ConnectWise to disable a handful of plugins in hundreds of customer environments. Security outfit Huntress first raised the alarm in a Reddit post on Wednesday, warning of an active campaign targeting cloud-hosted ScreenConnect instances. At the ...
- Remus malware claims Gmail access even after you change your password
November 11, 2026
Changing your password should be part of recovering a compromised account. The developers of Remus Stealer are advertising a Gmail-reading feature they claim can survive that step and even session revocation. That is a serious claim. It is not, however, a demonstrated capability in the published investigation. Threat intelligence company Hudson Rock examined Remus’s promotional material ...
- Critical vulnerabilities in N-able N-central prompt hosted shutdown
November 10, 2026
On November 9, 2026, N-able announced that it was responding to the public disclosure of critical vulnerabilities affecting N-central, its remote monitoring and management (RMM) platform. In a public disclosure titled Able2Shell, an independent researcher has published details and proof-of-concept (PoC) code covering 33 issues. According to the disclosure, the issues include unauthenticated remote code execution ...
- Microsoft’s Azure Linux gets 470-plus security fixes in one almighty patching session
November 9, 2026
Microsoft has unleashed a whopper of an update for Azure Linux, packing more than 470 CVE fixes into a single release as the software industry’s ever-growing pile of vulnerabilities shows little sign of shrinking. Over the weekend, Microsoft rolled out Azure Linux 3.0.2022 with fixes covering everything from the Linux kernel to open source packages and ...