TeleMessage SGNL’s /heapdump Leak Exposes Gov Credentials, Actively Exploited
A misconfigured /heapdump endpoint in TeleMessage SGNL, the Signal‑like app used by U.S. agencies, leaks 150 MB memory dumps containing usernames, passwords and session tokens. Researchers saw at least 11 IPs actively pulling these dumps, and CISA added CVE‑2025‑48927 to its KEV list. The flaw was patched in early May, but the incident underscores the danger of outdated Spring Boot defaults.