Hackers are continuing to seek out opportunities to exploit the infamous CVE-2025-48927 vulnerability involved in TeleMessage, according to a new report from threat intelligence company GreyNoise.

GreyNoise’s tag, which monitors attempts to take advantage of the vulnerability, has detected 11 IP addresses that have attempted the exploit since April.

Other IP addresses may be performing reconnaissance work: A total of 2,009 IPs have searched for Spring Boot Actuator endpoints in the past 90 days, and 1,582 IPs have specifically targeted the /health endpoints, which commonly detect Spring Boot Actuator deployments.

The flaw allows hackers to extract data from vulnerable systems. The issue “stems from the platform’s continued use of a legacy confirmation in Spring Boot Actuator, where a diagnostic /heapdump endpoint is publicly accessible without authentication,” the research team told Cointelegraph.

TeleMessage is similar to the Signal App but allows for the archiving of chats for compliance purposes. Based in Israel, the company was acquired by US company Smarsh in 2024, before temporarily suspending services after a security breach in May that resulted in files being stolen from the app.

“TeleMessage has stated that the vulnerability has been patched on their end,” said Howdy Fisher, a member of the GreyNoise team. “However, patch timelines can vary depending on a variety of factors.”

Although security weaknesses in apps are more common than desired, the TeleMessage vulnerability could be significant for its users: government organizations and enterprises. Users of the app may include former US government officials like Mike Waltz, US Customs and Border Protection and crypto exchange Coinbase.

GreyNoise recommends users block malicious IPs and disable or restrict access to the /heapdump endpoint. In addition, limiting exposure to Actuator endpoints may be helpful, it said.

Related: Threat actors using ‘elaborate social engineering scheme’ to target crypto users — Report

Crypto theft rising in 2025; credentials on darknet go for thousands

Chainalysis’ latest crime report notes that over $2.17 billion has been stolen so far in 2025, a pace would take crypto-related thefts to new highs. Notable security attacks over the past months include physical “wrench attacks” on Bitcoin holders and high-profile incidents such as the February hack of crypto exchange Bybit.

Attempts to steal credentials often involve phishing attacks, malicious malware, and social engineering. 

Magazine: Coinbase hack shows the law probably won’t protect you — Here’s why

Today, we disclosed the first set of vulnerabilities from the Ethereum Foundation’s Bug Bounty Programs. These vulnerabilities were previously discovered and reported directly to the Ethereum Foundation or client teams via the Bug Bounty Programs for both the Execution Layer and Consensus Layer.

Through its Bug Bounty Programs, which allow the Ethereum Foundation (EF) to coordinate and cross-check vulnerabilities across clients, the EF currently accepts vulnerability reports for Nimbus, Teku, Lighthouse, Prysm, Lodestar, Go Ethereum, Nethermind, Erigon and Besu.

New repository & vulnerability list

The full list of vulnerabilities, along with additional information, can be found in a git repository here.

The new disclosures repository catalogues all known vulnerabilities that were patched prior to the latest hardforks on the Execution Layer and Consensus Layer.

We would like to give a massive shout out to everyone involved in the discovery and reporting of vulnerabilities, as well as to the teams responsible for fixing them. While we have attempted to include the names or aliases of the reporters, there are many developers and researchers within the client teams and in the Ethereum Foundation who found and corrected vulnerabilities outside of the bounty program. There are also many unsung heroes such as client team developers, community members, and many more who have spent countless hours triaging, cross-checking, and mitigating vulnerabilities before they could be exploited.

For more information, and to learn more about disclosure policies, timelines, and cataloging, head over to the new disclosures repository.

Your immense efforts have been instrumental to ensuring Ethereum’s security. Thank you!

Today, we have disclosed the second set of vulnerabilities from the Ethereum Foundation Bug Bounty Program! These vulnerabilities were previously discovered and reported directly to the Ethereum Foundation.

When bugs are reported and validated, the Ethereum Foundation coordinates disclosures to affected teams and helps cross-check vulnerabilities across all clients. The Bug Bounty Program currently accepts reports for the following client software:

• Erigon
• Go Ethereum
• Lodestar
• Nethermind
• Lighthouse
• Prysm
• Teku
• Besu
• Nimbus

In addition to client software, the Bug Bounty Program also covers the Deposit Contract, Execution Layer & Consensus Layer Specifications and Solidity.

Repository & vulnerability list

Since the last vulnerability disclosure has been quite eventful with events such as the Merge and the max bounty reward increase to $250,000.

The highest paid reward during this period was $50,000. This was awarded to scio for reporting an issue in which Lighthouse beacon nodes crashed via malicious BlocksByRange messages containing an overly large count value. You can read more about this specific vulnerability here.

Another notable set of vulnerabilites has been around fork choice attacks. EF researchers and client teams investigated and patched attacks that were able to cause long reorgs.

Guido Vranken holds the top spot most positive reports in this period. At the same time, Guido managed to collect the most points for the Bug Bounty Leaderboard!

We also have two bounty hunters who decided to donate their rewards to charities: nrv and PwningEth!

The full list of new vulnerabilities, along with full details, can be found in the disclosures repository.

All vulnerabilities added to the disclosures catalogue were patched prior to the latest hardforks on the Execution Layer and Consensus Layer.

For more information, and to learn more about disclosure policies, timelines, and cataloging, head over to the disclosures repository.

Thank you

We would like to give a massive shout out to everyone involved in the discovery and reporting of vulnerabilities, as well as to the teams responsible for fixing them. While we have attempted to include the names or aliases of all reporters, there are many developers and researchers within the client teams and in the Ethereum Foundation who found and corrected vulnerabilities outside of the bounty program. There are also many unsung heroes such as client team developers, community members, and many more who have spent countless hours triaging, cross-checking, and mitigating vulnerabilities before they could be exploited.

Your immense efforts have been instrumental to ensuring Ethereum’s security. Thank you!