Android security update: two-minute patch check for SMS of Death WAP Push crash
8 min read | Updated: October 30, 2026 | First published: October 30, 2026 | Sources: Android Security Bulletin October 2026, Google Android Help, SMS of Death write-up 29 Oct 2026 | By Guerni Ala Eddine
TL;DR: A researcher published "SMS of Death" on 29 October 2026: one silent WAP Push text can crash Android's calling process with no tap. In his tests, live calls dropped - including emergency calls - and the message never landed in Messages. Twitter is shouting "Google refused to patch it." That is half the story. Google's bug-bounty desk called it a non-security issue and issued no CVE. The same write-up says Android still shipped a telephony crash-catch in the October 2026 security release for Android 14-17. This guide is the two-minute patch-date check - not a horror thread and not a copy of the sending tool.
Quick answer - what do I tap right now? Settings → About phone (on many Samsungs: About phone → Software information) → Android security update. You want October 1, 2026 or any later date. Then Settings → System → Software update → Check for update → install → reboot. iPhone is not this bug. Do not install an "SMS of Death" APK from GitHub or Telegram. That file is a sender, not a shield.

What Broke, in Plain Language

Your Messages app is not the whole SMS stack. Android's phone process (com.android.phone) also eats a class of silent carrier messages called WAP Push. Researcher Mark Blaszczyk showed that a malformed one of those can kill that process. You do not open it. You do not see a thread. The attacker needs a phone number, not your PIN.

His tests: Pixel 9 on April 2026 firmware and several Galaxy / A-series units, 100% crash. One hit: a second or two of no cell radio, and an active call dies. Carrier retries can keep hitting the same number. Many hits, in his lab, left SMS storage in a bad state so the process died again on every boot - the shape that drives a normal person to tap Wipe data.

We are not going to pretend the two Google stories are the same paragraph. VRP tickets: closed, "does not meet the severity threshold," Non-Security Issue, 29 October 2026, no CVE. AOSP: a June 2026 telephony change that swallows the crash and deletes the poison message so it cannot loop; the researcher says that change shipped in October 2026 for Android 14 through 17. Your home-reader job is not to referee Mountain View. It is to read the date under About phone.

This page will not print the payload, the GitHub APK, or how to fire a data SMS. Those are a working weapon. Sharing them here would not protect anyone.

Who This Actually Hits

SetupIn scope?Why
Android 14-17, security update before 2026-10-01, SIM in the phoneYesPre-October telephony stack on the researcher's ship note
Android, security update 2026-10-01 or later (Pixel often shows 2026-10-05)Check once, then stopOctober floor is in
Android that no longer gets monthly security updatesYes, and the update will never arriveReplace the phone; do not wait
iPhoneNoDifferent stack. Not this write-up.
Wi-Fi tablet, no SIMNo cellular pathStill take Play system updates for other bugs

U.S. and everyone else with a number on Android: this is not "don't click the link." There is no link. BYOD work phones that skip OEM updates for months are the quiet majority - same habit we keep hitting in the Authenticator build check.

The Two-Minute Check

  1. Read the patch date. Settings → About phone → Android security update. Google's October 2026 Android Security Bulletin (5 October, updated 8 October) says levels 2026-10-01 or higher address that bulletin. Pixel's own October note uses 2026-10-05. Either date, or anything newer, is the floor we are using.
  2. Pull the OEM package. Wi-Fi, battery not dying, Settings → System → Software update → Check for update. Install. Reboot. The date does not move until the reboot finishes. Do not flash a random "October ROM."
  3. Play system update. Same Settings tree, Google Play system update if the row exists. Extra Android code. It does not replace the security date. Tap it anyway.
  4. Stop. If the date is October 1 or later, you are done for this story. Inbox filters, "block unknown SMS," and antivirus apps do not see WAP Push the way they see a smishing link.
What you seeStatusNext step
Android security update 2026-10-01 or laterOctober floorDone. Keep auto-update on
September 2026 or older, updates still offeredNeed the October packageInstall, reboot, read the date again
Old date, "your device is up to date"OEM stopped patching that modelNew phone. Not a settings trick
Phone already reboot-loopsDo not start with Wipe dataRecovery order below

If It Already Loops: Order Matters

Factory reset first is the trap. The researcher: wipe clears local SMS storage; the carrier can redeliver the same silent messages to the same number; Android crashes again. So:

  1. Do not tap Wipe data at the recovery prompt as step one.
  2. Pull the SIM. Park it in a non-Android phone, or in an Android that already shows 2026-10-01+, long enough for the network to deliver and clear the retry queue.
  3. If you cannot move the SIM, call the carrier: line in a boot loop after silent SMS, please clear retries. There is no CVE name to give them.
  4. Only then bring the SIM back - after About phone shows October. Airplane mode on Wi-Fi is fine while an update downloads; it is not a lifestyle. You cannot place a cell emergency call in airplane mode.
  5. Shops with a cable can clear a pending SMS queue if USB debugging was already on. If it was off, that door is closed. We are not pasting shell from the PoC repo.

Play Protect will not toast this. It is not a sideloaded game. If you also use work Microsoft accounts on the same Android, that is still the Authenticator article, not this one.

Takeaways

  • The fix you can actually do: Android security update 2026-10-01 or later, then reboot.
  • "Don't open the text" does not apply. There is no text in the inbox.
  • Google VRP: no CVE. October AOSP still shipped a crash-catch per the researcher. Read the date anyway.
  • Wipe data is not first aid while the SIM still eats carrier retries.
  • The public APK is not protection. Do not "test" family numbers with it.

FAQ

Samsung still on September. The OEM has not pushed Google's October package to that model yet. Check Software update daily. No unofficial firmware.

Pixel shows October 5, 2026. That is Pixel's October bulletin. You are above 2026-10-01.

WhatsApp-only, I never use SMS. The cell radio still receives data SMS. WhatsApp does not patch telephony.

Is this a worm / are they in my bank? The published issue is denial of service on calling/SMS, not a documented bank-token steal. Do not skip the patch because it is "only DoS." You still need the radio for 911/112.

Should I stop using Android? No. Install October. Same advice as every other monthly bulletin, with a louder headline this week.

About the author. Guerni Ala Eddine writes practical device checklists for ACSNETWORLD. This article uses Google's October 2026 Android Security Bulletin, Google Android Help for the patch-date path, and the 29 October 2026 SMS of Death write-up for impact and the researcher's October ship note. It does not include exploit code.

Sources

  1. Android Security Bulletin - October 2026
  2. Google Android Help - Check and update your Android version
  3. Pixel Update Bulletin - October 2026
  4. SMS of Death - public write-up (29 Oct 2026)

Changelog. October 30, 2026 - Rewritten to ACSNETWORLD two-minute-check voice (Authenticator-class): What Broke, who is in scope, patch-date steps, recovery order, no PoC.