Compromised SIM Cards Exploit Proactive SIM to Steal Files, Execute Code and Force 2G on Smartphones and IoT Devices
Researchers from the University of Birmingham and Fuzzware have shown that a compromised SIM card can take control of certain smartphones and IoT devices by abusing a built-in cellular standard feature. The attack allows file theft, disabling of connectivity, forced downgrade to 2G networks and even arbitrary code execution.
The technique relies on the Proactive SIM capability, which lets the SIM card itself send instructions to the modem. Specifically, the RUN AT command forces the modem to execute AT commands, a control language dating back to the 1980s. This creates a direct, standards-compliant channel from the SIM card to the device hardware.
To validate the findings, the researchers developed the CATana toolkit and evaluated 18 smartphones plus eight cellular-connected devices. The AT command interface was reachable from the SIM on two phones and seven IoT units. In total, four vulnerabilities were discovered and weaponized to achieve code execution, file exfiltration, denial of service and forced 2G downgrade.
On an AUTEL charging station equipped with a Quectel EC25-AFX module, commands from the SIM card resulted in command injection and code execution. The OPPO Reno14 F 5G accepted 198 AT commands and variants, allowing the device to be powered off, the modem stopped or the connection forced to 2G. The downgrade persisted across airplane mode, SIM removal and network setting changes, opening the door to rogue base-station attacks because 2G lacks network authentication.
In the Quectel EG25-G modem, researchers combined SIM-issued commands with a malicious symbolic link to exfiltrate chosen files to an attacker-controlled server. All attacks require prior control of the SIM card, which could be obtained through existing vulnerabilities, physical replacement, remote management infrastructure or supply-chain tampering.
Some manufacturers have already issued patches. GSMA has registered the issue as CVD-2026-0122. The researchers argue that repeatedly patching RUN AT is insufficient and recommend removing the function from device firmware altogether.
Related articles
SonicWall Global Management System Hit by Critical RCE and Path Traversal Vulnerabilities
SonicWall has disclosed six vulnerabilities in its SonicWall Global Management System (GMS) management product, with the highest-severity issues rated Critical. The most severe flaw, CVE-2026-66147, resides in the Dispatcher Service and allows unauthenticated remote code execution through crafted requests that inject commands. A second critical issue, CVE-2026-66145, stems from improper handling of zip archive extraction and enables path traversal attacks that can read sensitive data or write arbitrary files without authentication. Both vulnerabilities received CVSSv3 base scores above 9.0. The flaws affect both the virtual appliance and Windows versions of GMS. SonicWall released an advisory on August 11 urging immediate application of the available updates.
Adobe Issues Critical Security Updates for ColdFusion with Multiple High-Severity Vulnerabilities
Adobe has released security updates for Adobe ColdFusion to address 15 vulnerabilities disclosed in a security advisory on August 11, 2026. Among them, CVE-2026-48362 is an OS command injection flaw that allows arbitrary code execution and carries the maximum CVSSv3.1 base score of 10.0. Two additional issues, CVE-2026-48273 involving dynamic code evaluation and CVE-2026-71384 related to authorization bypass leading to denial of service, received scores of 9.9 and 9.6 respectively. Eight further vulnerabilities were rated Critical, prompting Adobe to urge immediate patching. The advisory highlights risks across multiple attack vectors and emphasizes rapid remediation to prevent potential exploitation.
Russian Researchers Patent Detector Blinding Protection for Quantum Key Distribution Systems
Engineers from SFB Lab and the Center for Quantum Technologies at Moscow State University have developed a new method to protect quantum key distribution systems against detector blinding attacks. The technique not only detects the attack but also preserves the secure portion of the generated key instead of discarding the entire key after an alarm. The approach works by randomly varying the quantum efficiency of single-photon detectors at the receiver side, forcing an attacker to leave detectable traces such as erroneous or double clicks. These statistical anomalies allow the system to estimate the number of potentially compromised bits and remove them during privacy amplification. The solution has been granted Russian patent RU 2 856 208 C1 and accepted for publication in Physical Review Applied. It was validated on commercial off-the-shelf detectors and requires no changes to the optical scheme, making it compatible with a wide range of existing QKD hardware.
5 NetworkPolicy Mistakes That Leave Kubernetes Clusters Completely Unprotected
A detailed analysis from OTUS highlights five frequent configuration errors in Kubernetes NetworkPolicy that allow unrestricted traffic despite policies appearing active in the cluster. The article explains that Kubernetes itself does not enforce NetworkPolicy objects; enforcement depends entirely on the CNI plugin such as Calico, Cilium, or Weave Net, while Flannel and kubenet ignore them entirely. Common pitfalls include blocking DNS resolution when applying default-deny egress rules, incorrect use of namespaceSelector versus podSelector leading to overly permissive access, and confusing the top-level podSelector with selectors inside ingress or egress blocks. Additional issues arise when policies fail to account for ingress controllers, hostNetwork pods, or inter-container localhost communication within the same pod. The piece stresses the importance of traffic-based validation rather than relying on kubectl output and recommends testing with deny-all policies plus continuous monitoring during rollout.