Skip to content
Projects

W00t3k/Awesome-Cellular-Hacking

View on GitHub

W00t3k/Awesome-Cellular-Hacking has 4,121 GitHub stars and 678 forks. GitHot measured +13 in 7 days. Last checked 2026-11-11 05:08 UTC. Last push 2026-08-28.

How these counts are measured

Awesome-Cellular-Hacking

4,121 stars678 forks

Measured star growth

in 24h
Update delayed
in 7 days
+13
in 15 days
Collecting history
in 1 month
Collecting history

Net star changes over overlapping periods, not daily totals. Missing measurements are left blank. Stars measure attention, not software quality.

README.md

Original

Awesome Cellular Hacking

A comprehensive curated list of resources for 2G/3G/4G/5G cellular security research and analysis

This repository consolidates community knowledge in the cellular security space, including exploits, research papers, tools, and educational resources. The goal is to preserve and organize important security research that might otherwise become difficult to find.

Disclaimer: This information is intended for educational and defensive security research purposes only. Use responsibly and in compliance with applicable laws and regulations.

Table of Contents

Getting Started

New to cellular security research? This section outlines the recommended path for building foundational skills.

Skill Levels

Beginner (passive listening only)

  • Hardware: RTL-SDR V3 or V4 ($35-$40), a laptop running Linux
  • Software: GNU Radio, GQRX, gr-gsm
  • First project: Scan and decode GSM frames passively using gr-gsm and Wireshark
  • Reading: NIST SP 800-187 LTE Security Guide

Intermediate (active research lab)

  • Hardware: HackRF One or LimeSDR Mini ($139-$350), programmable SIM cards (sysmoUSIM), a spare Android device
  • Software: srsRAN 4G, Open5GS or Free5GC, OsmocomBB
  • First project: Build a private LTE network in a Faraday cage and connect a test device
  • Reading: srsRAN documentation, Open5GS tutorials

Advanced (protocol fuzzing and baseband research)

  • Hardware: USRP B210 or BladeRF 2.0, multiple test devices
  • Software: 5GBaseChecker, LTEFuzz, BaseBridge, SigPloit, FirmWire, 5GHOUL
  • Focus areas: Baseband fuzzing, RAN-Core interface testing, SS7/Diameter signaling

Lab Setup Checklist

  • Linux host (Ubuntu 22.04 or 24.04 recommended)
  • UHD drivers installed and device recognized (uhd_find_devices)
  • Faraday cage or RF shielding for active transmissions
  • Programmable SIM cards (sysmoUSIM-SJA2 or similar)
  • Dedicated test devices (not your daily driver)
  • Isolated network environment (no production network access)

Key Concepts to Understand First

Rogue Base Stations

GSM/CDMA Traffic Impersonation and Interception

Recent Updates (2024-2026)

New Research (2025-2026)

New Research (2024)

Base Station Software and Tools (Updated)

  • OpenBTS 2024 Reloaded — Updated for modern UHD drivers and Ubuntu 22.04/24.04
  • OpenAirInterface (OAI) — Complete 3GPP Release-15+ implementation with active 5G development
  • LimeNET CrowdCell — Network-in-a-box with integrated LimeSDR for small cell deployments
  • Amarisoft LTEENB/gNB — Professional-grade LTE/5G NR base station software
  • DragonOS — Debian/Lubuntu-based SDR distro with cellular tools pre-installed; supports RTL-SDR, HackRF, LimeSDR, BladeRF; latest release is DragonOS Noble (24.04). Website
  • WarDragon — Passive RF sensor platform with AI-enhanced cellular survey capabilities; integrates with TAK; includes Ransack for multi-RAT survey
  • Magma Core Network — Meta's distributed packet core, now under the Linux Foundation
  • 5GBaseChecker — Automated 5G baseband vulnerability detection tool
  • Ransack — Multi-RAT cellular survey/recon platform; unifies LTE/5G NR/GSM/NB-IoT observations from SDRs, Qualcomm phones, and Rayhunter into SQLite with REST API
  • 5GHOUL — 5G NR fuzzing and attack framework targeting Qualcomm/MediaTek

Software and Tools

Base Station Software

Software Description Link
OpenBTS (2024 Reloaded) Updated Linux SDR-based GSM air interface for modern systems GitHub
OpenBTS (Original) Range Networks implementation SourceForge
YateBTS GSM/GPRS radio access network implementation Website
srsRAN Project Open-source 5G O-RAN CU/DU software suite GitHub
srsRAN 4G Open-source 4G software radio suite GitHub
OpenAirInterface Complete 4G/5G protocol stack Website
Free5GC Open-source 5G core network implementation GitHub
Open5GS Open-source 5G core and EPC implementation GitHub
Kamailio Open-source SIP server used in IMS/VoLTE labs Website

Configuration Guides

Analysis Tools

Tool Description Link
Ransack Multi-RAT cellular survey platform for DragonOS; merges LTE/5G NR/GSM/NB-IoT into unified DB; orchestrates srsRAN, LTESniffer, FALCON, Rayhunter GitHub
Rayhunter EFF's IMSI catcher detector for Orbic hotspots; detects 2G downgrades and suspicious requests GitHub
5GBaseChecker Automated 5G baseband vulnerability detection (Penn State) GitHub
5GHOUL 5G NR attacks against Qualcomm/MediaTek with stateful fuzzer GitHub
FirmWire Full-system baseband firmware emulation for fuzzing/debugging GitHub
BaseBridge Bridges OTA and emulation testing for baseband firmware GitHub
LTE-Cell-Scanner LTE cell detection and analysis GitHub
gr-gsm GSM analysis with GNU Radio GitHub
IMSI-Catcher Detector Android app for detecting IMSI catchers GitHub
CellGuard iOS app detecting rogue base stations via baseband analysis GitHub
QCSuper Capture 2G-4G traffic using Qualcomm phones P1 Security
FALCON LTE Fast analysis of LTE control channels in real-time GitHub
Kalibrate GSM base station scanner and frequency calibration GitHub
LTE Sniffer Open-source LTE downlink/uplink eavesdropper GitHub
OsmocomBB Free firmware for mobile phone baseband processors Osmocom
Modmobmap Mobile network mapping GitHub
Modmobjam Mobile jamming research tool GitHub
CITesting Context integrity violation testing for LTE core networks ACM DL
SigPloit SS7/Diameter/GTP/SIP signaling security testing framework GitHub
LTEFuzz LTE protocol fuzzer (KAIST) GitHub
LLFuzz LLM-guided baseband firmware fuzzing for MediaTek/Samsung Shannon Paper
Crocodile Hunter EFF tool for detecting rogue cell towers by wardriving GitHub
SCAT Signaling Collection and Analysis Tool for Qualcomm/Samsung GitHub
Hermes FSM synthesis from natural language specifications GitHub
CellularLint Inconsistency detection in 4G/5G standards GitHub
5GReasoner Property-directed formal verification of 5G control-plane protocols Paper
DoLTEst Downlink negative testing framework for LTE devices; 1,848 test cases Paper
ProChecker FSM extraction + model checking for 4G LTE implementations Paper
LTEInspector Property-driven adversarial model-based testing for 4G LTE Paper
BASECOMP Comparative analysis for baseband integrity protection GitHub
BaseTrace Framework for iPhone baseband interface research GitHub
ss7map SS7 network exposure mapping P1 Security
Osmocom Suite Complete open-source GSM/GPRS stack Osmocom

Hardware Setup

USRP Installation on Linux

# Add Ettus Research repository
sudo add-apt-repository ppa:ettusresearch/uhd
sudo apt-get update

# Install UHD drivers and tools
sudo apt-get install libuhd-dev libuhd003 uhd-host

# Find connected devices
uhd_find_devices

# Download firmware images
cd /usr/lib/uhd/utils/
./uhd_images_downloader.py

# Test device connection
sudo uhd_usrp_probe

SDR Hardware Options

Hardware Frequency Range Bandwidth Price Range Use Case Link
Ettus Research (USRP)
USRP B210 70 MHz - 6 GHz 61.44 MHz $2,100 Professional development, 2x2 MIMO Ettus
USRP B200mini 70 MHz - 6 GHz 61.44 MHz $775 Compact USRP B-series Ettus
USRP N210 DC - 6 GHz 25 MHz $1,700 High-performance networked SDR Ettus
USRP N320 1 MHz - 6 GHz 200 MHz $8,000 Networked 2x2 MIMO Ettus
USRP X310 DC - 6 GHz 160 MHz $6,000 High-performance desktop/rack Ettus
USRP X410 1 MHz - 7.2 GHz 400 MHz $15,000 Latest high-performance 4x4 MIMO Ettus
USRP X440 30 MHz - 4 GHz 1.6 GHz $25,000+ Latest 8x8 MIMO RFSoC platform Ettus
USRP E320 70 MHz - 6 GHz 56 MHz $4,000 Embedded 2x2 MIMO SDR Ettus
Nuand (BladeRF)
BladeRF 2.0 xA4 47 MHz - 6 GHz 61.44 MHz $420 Budget 2x2 MIMO development Nuand
BladeRF 2.0 xA9 47 MHz - 6 GHz 61.44 MHz $720 High FPGA resources, 2x2 MIMO Nuand
BladeRF x40 (Legacy) 300 MHz - 3.8 GHz 40 MHz $400 Entry-level legacy model Nuand
Great Scott Gadgets
HackRF One 1 MHz - 6 GHz 20 MHz $350 Budget TX/RX development GSG
YARD Stick One 300-348, 391-464, 782-928 MHz 2.5 MHz $110 Sub-GHz IoT frequencies GSG
Lime Microsystems
LimeSDR USB 100 kHz - 3.8 GHz 61.44 MHz $289 Open-source 2x2 MIMO Lime Micro
LimeSDR Mini 10 MHz - 3.5 GHz 30.72 MHz $139 Compact LimeSDR variant Lime Micro
LimeSDR Mini 2.0 10 MHz - 3.5 GHz 30.72 MHz $169 Updated with ECP5 FPGA Lime Micro
LimeSDR X3 Various bands Up to 61.44 MHz $3,000+ Professional 3x transceiver PCIe Lime Micro
Analog Devices
PlutoSDR 325 MHz - 3.8 GHz 20 MHz $150 Education and learning platform Analog Devices
RTL-SDR Blog
RTL-SDR V3 500 kHz - 1.75 GHz 3.2 MHz $35 Ultra-budget RX-only scanner RTL-SDR
RTL-SDR V4 500 kHz - 1.75 GHz 3.2 MHz $40 Latest with R828D tuner RTL-SDR
Airspy
Airspy R2 24 MHz - 1.8 GHz 10 MHz $200 High-performance VHF/UHF scanner Airspy
Airspy Mini 24 MHz - 1.8 GHz 6 MHz $99 Compact Airspy in dongle format Airspy
Airspy HF+ Discovery 9 kHz - 31 MHz, 60-260 MHz 768 kHz $169 Dedicated HF reception Airspy
SDRplay
RSP1A 1 kHz - 2 GHz 10 MHz $119 Wideband general purpose SDRplay
RSPdx 1 kHz - 2 GHz 10 MHz $299 Professional features, dual antenna SDRplay
Red Pitaya
STEMlab 125-14 DC - 60 MHz 50 MHz $600 HF transceiver, lab instrument Red Pitaya
STEMlab 122-16 DC - 50 MHz Variable $625 High-resolution HF SDR/scope Red Pitaya

Common SDR Issues and Troubleshooting

Issue Possible Causes
Device not detected Improper firmware, USB connection issues
Poor signal quality Incorrect antennas, wrong frequency configuration
Connection failures Wrong SIM, incorrect MCC/MNC codes
Performance issues Virtualized platform limitations, wrong SDR firmware

Testing and Research Methodologies

Modern Baseband Fuzzing (2024-2026)

  • SNI5GECT: Practical 5G Traffic Injection — USENIX Security 2025

    Sniff and inject 5G messages without rogue base stations or jamming. Demonstrated 4G downgrade attacks within 20 meters of victim. GitHub

  • "NASty" 5G Baseband Vulnerabilities through Dependency-Aware Fuzzing — Black Hat USA 2025

    Targeting Non-Access Stratum (NAS) layer vulnerabilities using dependency-aware fuzzing. Discovered security bypass using "!!FAKE-TESTHARNESS!!" message. Symbolic execution challenges with Samsung Shannon basebands requiring TB-level memory.

  • Budget-Friendly Baseband Fuzzing Setup — DefCon 32, Janne Taponen

    Covers building cost-effective baseband fuzzing rigs using SDRs, using LLMs to accelerate protocol parser development, and testing automotive ECUs, payment terminals, and mobile devices.

  • RANsacked Fuzzing Framework — University of Florida / NC State, ACM CCS 2024

    Domain-informed fuzzing approach targeting RAN-Core interfaces. Discovered 119 vulnerabilities across ten network implementations.

  • BaseBridge — IEEE S&P 2025

    Framework that bridges over-the-air and emulation-based testing for cellular baseband firmware. Extends FirmWire.

  • FirmWire — NDSS 2022

    Full-system baseband firmware emulation platform for Samsung and MediaTek. Discovered 8 remote memory corruptions including 3 pre-authentication RCE vulnerabilities.

Vulnerability Research Tools

  • 5GBaseChecker — Automated 5G baseband vulnerability detection
  • 5GHOUL — Stateful 5G NR fuzzer with OTA attack capabilities
  • LLFuzz — LLM-guided baseband fuzzing for MediaTek/Samsung Shannon (KAIST 2025)
  • CITesting — Context integrity violation testing for LTE core networks
  • Kairos — Timing-induced interaction failure testing
  • ASTRA-5G — Automated OTA security testing for 5G SA devices
  • certmitm — TLS implementation testing tool

Attack Vectors

Radio Jamming Attacks

From NIST SP 800-187:

  • Smart Jamming — Targeted channel interference timed to avoid detection
  • Dumb Jamming — Broadband noise across frequency ranges
  • UE Interface Jamming — Preventing UE signaling to eNodeB
  • eNodeB Interface Jamming — Disrupting base station communications

Overshadowing Attacks (2024-2026)

  • 5Gone: Uplink Overshadowing in 5G-SA — Feb 2026

    Uplink overshadowing attack transmitting at same time/frequency as victim with higher power. Enables surgical DoS, privacy leaks, and downgrade attacks. Runs on COTS x86 hardware.

  • AdaptOver: Adaptive Overshadowing Attacks — 2022

    Adversary can decode, overshadow, and inject arbitrary messages OTA in either direction. Can cause persistent DoS (≥12h) or force IMSI transmission in plaintext. Demonstrated on live LTE/5G-NSA networks at 3.8km range.

5G Security Research

LTE/4G Security Research

Conference Talks

Black Hat Asia 2026

  • Qualcomm BootROM Vulnerability (CVE-2026-25262) — Kaspersky ICS CERT

    Hardware-level vulnerability in Qualcomm chipsets' Emergency Download Mode (EDL). Unpatchable BootROM flaw allows attackers with physical access to write arbitrary data to memory, potentially gaining full device control. Affects MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952, SDX50 series.

Black Hat USA 2025

DEF CON 33 (August 2025)

Black Hat USA 2024

DEF CON 32 (August 2024)

OffensiveCon 2025

ACM CCS 2025

IEEE S&P 2025

USENIX Security 2025

USENIX Security 2024

USENIX Security 2023

Previous Years

Research Papers

2026

2025

2024

2023

2019-2022

Equipment and Hardware

Research Equipment Used in "Over The Air Baseband Exploit"

Component Purpose Link
Ettus USRP B210 Software Defined Radio Product Page
srsENB 4G/5G Base Station Software GitHub
Open5GS 5G Core Network GitHub
sysmo-usim-tool SIM Programming Project Page
pysim SIM Analysis Tool GitHub
CoIMS VoLTE Testing Play Store
Docker Open5GS Containerized Core Tutorial

Detection and Defense

Protection from Stingrays and IMSI Catchers

  • Rayhunter — EFF, 2025

    Open-source IMSI catcher detector that runs on affordable Orbic mobile hotspots (~$20-30). Analyzes control traffic in real-time looking for 2G downgrade attempts and unusual IMSI requests. Thousands deployed worldwide with community-contributed packet captures. Documentation — Blog Post

  • CellGuard — SEEMOO Lab, 2024

    iOS app that detects rogue base stations by analyzing baseband packets in real-time. Integrates with the Apple Cell Location Database for anomaly detection. Website — Research Paper

  • BaseTrace — SEEMOO Lab

    Framework for researching the interface between iPhone's application processor and baseband.

IMSI Catcher Detection and Research

Security Advisories

Cellular IoT and NB-IoT Security

Satellite-Cellular Integration

Private 5G Network Security

Network Slicing and Edge Security

Automotive and Industrial Cellular

Forensics and Investigation

Vulnerability Disclosure

SIM Security

SIM Swap Attack Prevention and Detection

SIM Vulnerability Research

SS7 and Telecom Infrastructure

SS7 Attack Research

SS7/Diameter Testing Tools

  • SigPloit — Modular testing framework for SS7, Diameter, GTP, and SIP; covers location tracking, call/SMS interception, and DoS scenarios
  • ss7map — Automated SS7 network topology and exposure mapper
  • SCTP scanner — Discovers SCTP-based SS7 endpoints on IP networks

Surveillance Technology

Stingray / IMSI Catchers

Recent CVEs and Updates

2026 Notable CVEs

  • CVE-2026-25262 — Qualcomm BootROM (Sahara protocol) unpatchable vulnerability; affects MDM9x07, MDM9x45, MDM9x65, MSM8909, MSM8916, MSM8952, SDX50 series
  • CVE-2026-21385 — Qualcomm Graphics memory corruption; exploited in targeted attacks on Android
  • MediaTek March 2026 Bulletin — CVE-2026-20423 through CVE-2026-20445 affecting MT7902, MT7920, MT7921, MT7922, MT7925, MT7927

2024-2025 Notable CVEs

  • CVE-2023-24033 (Google Project Zero) — Samsung Exynos baseband: internet-to-baseband RCE via malformed SDP in VoLTE/VoWiFi; no user interaction required. Part of 18 zero-day disclosure affecting Pixel 6/7, Galaxy S22, Vivo, and Samsung wearables
  • CVE-2024-55568 — Samsung Exynos baseband heap buffer overflow in SDP parsing; remote code execution via crafted VoLTE packets
  • CVE-2024-25073 — Samsung Shannon baseband: pointer not properly checked in Call Control module, leads to DoS
  • CVE-2025-58349 — Samsung: incorrect handling of LTE MAC packets with many MAC Control Elements causes baseband crash
  • Open5GS CVEs (2024-2025) — Multiple DoS vulnerabilities including NULL pointer dereferences and assertion failures
  • RANsacked: 97 CVEs — Affecting Open5GS, Magma, OAI, Athonet, SD-Core, NextEPC, srsRAN

CVE Resources

International Research

Training and Education

Professional Training

Lab Environments

Vendor-Specific Research

Roaming and Interconnect Security

Resources

GitHub Collections

Development and Analysis Tools

Research Collections

Legal and Regulatory

Video Tutorials

Additional Reading

Community

Mailing Lists and Forums

IRC and Chat

  • Osmocom IRC — #osmocom on libera.chat; real-time support for Osmocom tools
  • DEF CON RF Village — Annual RF hacking community track at DEF CON

Notable Researchers and Organizations to Follow

Name/Organization Focus Area Link
Syed Rafiul Hussain 5G/LTE protocol security, baseband fuzzing Website
Imtiaz Karim 5GReasoner, LTE noncompliance, cellular formal verification Website
KAIST SysSec Lab LTE/5G core network security Website
SEEMOO Lab (TU Darmstadt) iOS baseband, IMSI catcher detection GitHub
ASSET Research Group 5G NR fuzzing (5GHOUL, SNI5GECT) Website
cemaxecuter DragonOS, WarDragon, Ransack cellular survey tools Twitter / Website
taszk.io Samsung/MediaTek baseband exploits, full-chain RCE Website
Google Project Zero Baseband vulnerability research, Exynos zero-days Blog
PentHertz RF/wireless security pentesting Twitter
P1 Security SS7/Diameter security Website
EFF Surveillance tech, Rayhunter, Crocodile Hunter Website

Conferences and Competitions

  • DEF CON — RF Village, Wireless Village, and main track cellular talks
  • Black Hat USA/Europe — Regular cellular/baseband research presentations
  • OffensiveCon — Baseband exploitation talks and training
  • Pwn2Own Ireland — Mobile-focused; $100K for baseband RCE exploits
  • CanSecWest — Baseband and mobile security research presentations
  • WiSec — ACM Conference on Security and Privacy in Wireless and Mobile Networks
  • IEEE S&P / CCS / USENIX Security — Top-tier academic venue for cellular security papers
  • HITB — Regular telecom security talks
  • NDSS — Network security including FutureG workshop on 5G/6G

Contributing

Fork the repo, add resources with descriptions, verify links are active, and submit a pull request with context on what was added.

Legal Notice

This repository is for educational and research purposes only. Users are responsible for complying with all applicable laws and regulations. The maintainers do not endorse or encourage illegal activities.

Last Updated: August 2026 Maintainer: @W00t3k

Broken links or new resources? Open an issue or submit a PR.

Verified Cellular Security Research Additions (September-November 2026)

Append-only research update, November 3, 2026. The original resources above have been retained without modification. Entries below link to original research, published papers, vendor bulletins, or registered vulnerability disclosures. A published CVE or laboratory proof of concept does not by itself establish exploitation in the wild.

SMS, Messaging, and Mobile Network Availability

  • SMS of Death: Zero-Click Android Telephony DoS (CVE-2026-58882) — Mark B, Oct 29, 2026

    Malformed WAP Push SMS messages trigger an exception in Android's telephony framework, crashing com.android.phone without user interaction and disrupting active calls, including emergency calls. Repeated processing can cause persistent service disruption or reboot loops on affected devices. Google Security Bulletin — Critical DoS; security patch level 2026-11-01.

  • Android November 2026 Security Bulletin: Telephony and Modem Fixes — Google, Nov 2, 2026

    Official Android bulletin listing CVE-2026-58882 as a Critical System denial-of-service issue. Also includes critical MediaTek modem fixes and other platform vulnerabilities. Android and chipset patches may arrive on different schedules depending on device manufacturer and carrier.

  • Securing Cellular Network Availability Against Wireless Blackhole Attack — Computers Communications, 2026

    Research on fake base stations manipulating broadcast control signaling to draw multiple subscribers away from legitimate 4G/5G service. Discusses the Wireless Blackhole threat and availability-focused countermeasures.

LTE/5G Core Networks, PFCP, GTP-C, and Service-Based Interfaces

SIM Security and Cellular Baseband Research

  • CATana: On the Dangers of SIM-Originating AT Commands — University of Birmingham / Fuzzware, USENIX WOOT 2026

    Analyzes the SIM Toolkit RUN AT interface using the CATana toolkit. Nine of 26 tested smartphones and IoT devices exposed SIM-originating AT commands; researchers identified four vulnerabilities with impacts including command execution, file reading, 2G downgrade, and device denial of service.

  • SoK: Insecurity of Cellular Basebands — EURECOM / Avantix, USENIX WOOT 2026

    Systematization of cellular baseband attack surfaces and weaknesses, comparing static analysis, over-the-air testing, emulation, and fuzzing. Highlights current gaps in vulnerability discovery and baseband hardening.

  • CONSET: Confirmed 5G Pre-Authentication Baseband CVEs — University at Buffalo / Texas A&M, 2026

    Follow-up disclosure details for the CONSET work already listed above: MediaTek CVE-2025-20666, CVE-2025-20644, and CVE-2025-20703 were assigned after researchers found semantic RRC parsing vulnerabilities. The USENIX Security 2026 paper reports seven previously unknown vulnerabilities affecting 64 chipset models and more than 542 phone models. Conference Paper

2026 Chipset and Modem Security Advisories

  • MediaTek November 2026 Security Bulletin — MediaTek, Nov 2, 2026

    Vendor-confirmed Critical modem out-of-bounds-write vulnerabilities CVE-2026-20499 and CVE-2026-20545 through CVE-2026-20549, plus additional High and Medium modem findings. Affected chipsets span multiple smartphone and cellular-IoT product families; consult the bulletin for precise models and OEM patch delivery.

  • MediaTek October 2026 Security Bulletin — MediaTek, Oct 2026

    Includes Critical modem memory-corruption vulnerabilities CVE-2026-20519 and CVE-2026-20520, and additional modem issues involving memory safety and input validation. The vendor bulletin was updated on October 30, 2026.

  • CVE-2026-20540: MediaTek Modem DoS via Rogue Base Station — MediaTek, Oct 2026

    A modem out-of-bounds read that can cause remote denial of service after a user device connects to an attacker-controlled rogue base station. Exploitation requires that radio-access condition and does not require additional user interaction.

  • MediaTek July 2026 Security Bulletin — MediaTek, July 2026

    Discloses High-severity modem vulnerabilities CVE-2026-20457 through CVE-2026-20461, including improper input validation and potential modem crashes across a range of mobile chipsets.

  • MediaTek May 2026 Security Bulletin — MediaTek, May 2026

    Includes modem vulnerabilities CVE-2026-20449 (heap buffer overflow) and CVE-2026-20450 (reachable assertion), both rated High severity and capable of crashing affected modem implementations.

Detection, Defense, and Standards-Based Validation

  • NIST CSWP 36G: False Base Station — Applying 5G Cybersecurity and Privacy Capabilities — NIST NCCoE, Sep 30, 2026 (Initial Public Draft)

    Evaluates 5G device behavior across six simulated fake-base-station scenarios in NIST's 5G security testbed. Covers availability, privacy, and remaining denial-of-service risks despite stronger 5G protections.

  • NIST CSWP 36F: Initial NAS Message Security — NIST NCCoE, Aug 6, 2026 (Initial Public Draft)

    Explains how standards-defined 5G protections can encrypt and integrity-protect sensitive content in initial Non-Access Stratum messages, and describes how operators can test whether those protections are enabled in their deployments.

  • GSMA Mobile Telecommunications Security Landscape 2026 — GSMA, 2026

    Industry threat-landscape report documenting attack trends across networks, devices, and subscribers. Covers weaknesses in software implementations, barriers to launching attacks, supply chain exposure, and operational mitigation priorities.

  • ADAD: AI-Driven Detector for Fake Base Station and Signal Overshadowing Attacks — Computer Networks, Oct 2026

    Detection research focused on fake-base-station and signal-overshadowing threats in radio access networks, including the LTE control-plane procedures retained by 5G NSA and some satellite direct-to-cell deployments.

iOS Exploitation and Persistent Jailbreak Research (2026)

  • Coruna: The Mysterious Journey of a Powerful iOS Exploit Kit — Google Threat Intelligence Group, March 2026

    Advanced iOS exploit kit containing 23 exploits across five complete chains targeting iOS 13.0–17.2.1. Combines WebKit RCE, sandbox escapes, and kernel exploitation. Associated with surveillance and financially motivated attacks.

  • Calif: Persistent iPhone Jailbreak at Hexacon 2026 — Calif, October 2026

    Researchers demonstrated an untethered jailbreak on an iPhone 18 Pro running iOS 27.0.1, retaining root access following reboot. Also presented Signal and iMessage exploitation demonstrations. Technical details and public exploit code have not been released.

  • ARIstoteles: Dissecting Apple's Baseband Interface — April 2026

    Reverse engineering and fuzzing research targeting Apple's undocumented ARI interface between the application processor, CommCenter, and cellular baseband. Introduces automated Wireshark dissector generation and a framework for identifying baseband-facing attack surfaces.

Explore related projects

sindresorhus/awesome

😎 Awesome lists about all kinds of interesting topics [NOTE: Pull requests are temporarily disabled until I have a chance to catch up with the existing ones]

535,161 stars

EbookFoundation/free-programming-books

:books: Freely available programming books

401,485 stars

nilbuild/developer-roadmap

Interactive roadmaps, guides and other educational content to help developers grow in their careers.

371,803 stars

vinta/awesome-python

The definitive list that answers "I want to do X in Python, which tool should I use?"

333,992 stars