A security researcher has found a serious flaw in Android that lets an attacker crash a phone just by sending it a specially crafted text message. It has been nicknamed the “SMS of Death” and is tracked as CVE-2026-58882, rated critical.
The worrying part is that the person receiving the message does not have to do anything. There is no link to click and no attachment to open. This is known as a “zero-click” flaw.
What actually happens
According to the reports, a single message can drop a call or knock out mobile service. Repeated messages can push the phone into a reboot loop, restarting every minute or two, and in the worst case the only way out is a factory reset. The reports also warn it could affect emergency connectivity.
To be clear about what this is: the reported impact is a phone that crashes or stops working, not a phone whose data is stolen. But for a business that runs on its mobiles, a phone that keeps rebooting is a real problem, and a factory reset can wipe anything that was not backed up.
The catch: old phones will not be fixed
Google has patched the supported versions of Android. Phones that no longer receive updates, often handsets that are a few years old, will not get the fix and remain permanently exposed.
What to do this week
- Update every Android phone your team uses for work, including personal phones that receive work email or calls. Go to Settings, then System or Software update.
- Check the security patch date in Settings. If a phone has not had an update in a long time, it may be out of support.
- Plan to replace out-of-support phones, starting with the ones staff rely on for customer calls.
- Make sure phones are backed up, so a forced reset is an inconvenience rather than a loss of contacts, photos and files.
- Keep a list of work phones and their update status, so you know where you stand next time.
Worried this affects your business? Get a free 15-minute IT check – call Trends IT on 0485 011 911 or visit /contact/.