Hackers scanning for TeleMessage Signal clone flaw exposing passwords

Researchers and telemetry firms observed active scanning and exploitation attempts targeting CVE-2025-48927 in the TeleMessage SGNL app (a Signal-clone). The flaw stems from an exposed Spring Boot Actuator /heapdump endpoint that can leak Java heap dumps containing plaintext credentials and archived messages; GreyNoise reported thousands of scans and multiple exploit attempts, CISA added the vulnerability to the KEV, and Smarsh states cloud instances were patched while some on-prem installations may still be vulnerable.