Cyber

Who is affected

People with Android phones that don't yet have the November 1, 2026 security update. Google's November 2026 Android Security Bulletin lists the fix for Android 14, 15, 16 and 17. heise online reports the flaw appears to affect Android 12 and 13 as well, and those versions aren't expected to get a fix from Google. The researcher reproduced the attack on Google Pixel and Samsung Galaxy phones (Digital Trends). Hand-me-down phones given to kids or grandparents are the ones to check first.

What happened

On October 29, 2026, a security researcher publicly disclosed the bug and released a working exploit, according to BleepingComputer and Digital Trends. On November 2, 2026, Google listed it in its November 2026 bulletin as CVE-2026-58882, a denial-of-service bug rated Critical. A specially crafted text can crash the part of Android that runs phone service, which can disconnect a call in progress, including calls to emergency services (911 in the US), and the person doesn't have to tap anything (BleepingComputer). The message never shows up in the inbox (Digital Trends). The researcher says about 20 messages can trap a phone in a reboot loop (Digital Trends, heise online). The bug is not designed to steal passwords or personal information, and there is no confirmed evidence of widespread attacks (Digital Trends). We aren't sharing technical details of the attack.

What to do now

• Do this now: open Settings, check for a security update, and install it today. Google's path is Settings, then System, then Software updates (on Pixel phones it's Software update) (Google Android Help). Menus vary by brand.
• Check the date: in Settings, tap About phone, then Android version, and look at "Android security update." November 1, 2026 or newer has the fix, per Google's bulletin.
• If your phone shows an older date, install the latest update it offers and check again over the next few weeks. Updates arrive on the phone maker's and carrier's schedule (Google Android Help).
• If the phone runs Android 12 or 13 and offers nothing newer, Google says to contact the phone maker or carrier (Google Android Help). CyberSandberg tip: plan to retire or replace that phone, and don't make it a kid's only phone for emergencies.
• If a phone is stuck restarting, don't tap "Wipe data." The researcher says that prompt can appear and wiping erases everything (heise online). Get help from your carrier or phone maker first.

Dates

• Event date: researcher's public disclosure, Oct 29, 2026.
• Reported: Oct 30, 2026 (heise online). BleepingComputer and Digital Trends: Oct 31, 2026. Google bulletin published: Nov 2, 2026.
• Date checked: Nov 2, 2026.

Sources

1. Google, Android Security Bulletin, November 2026 (published Nov 2, 2026) (checked Nov 2, 2026; lists CVE-2026-58882, Critical, DoS, System, 2026-11-01 patch level, AOSP 14, 15, 16, 16-qpr2, 17)
2. BleepingComputer, "New Android SMS of Death exploit can remotely crash unpatched phones," Lawrence Abrams, Oct 31, 2026 (checked Nov 1, 2026)
3. Google Android Help, "Check & update your Android version" (checked Nov 1, 2026)
4. Digital Trends, "Android's new 'SMS of Death' exploit can crash your phone without you doing anything," Sudhanshu Kumar Mangalam, Oct 31, 2026 (checked Nov 1, 2026)
5. heise online, "'SMS of Death': Security flaw crashes Android phones," Andreas Floemer, Oct 30, 2026 (checked Nov 1, 2026)