TeleMessage TM SGNL: Open Heap Dump Endpoint Leaked Messages
There is nothing to patch: the flaws were in TeleMessage's hosted archive, suspended in May 2025, so former customers should treat archived messages and credentials as exposed and Spring Boot teams should confirm /heapdump is not public.
Must act: Organizations that used TeleMessage archiving apps (TM SGNL and its WhatsApp, Telegram and WeChat variants) before May 2025, and any team running Spring Boot Actuator on internet-facing services.
Can relax: Users of the official Signal app and organizations that never used TeleMessage; the flaws were in TeleMessage's servers, not in Signal.
- Confirm no device or account in your organization still uses a TeleMessage archiving app; follow CISA's guidance to mitigate or discontinue.
- Treat messages, contacts and phone numbers archived before May 2025 as exposed, and brief affected users and compliance.
- Rotate TeleMessage passwords, API keys and tokens, and any credentials users sent through the archived apps.