TLDR: Person posted about a tip, Signal investigated, turns out claim was unfounded and person took down post and apologized.
Issue was thought to be with the link previews
The rumors about an unknown vulnerability impacting Signal started when certain users on X, including @gaughen, posted about it, claiming that he had received a tip on its existence. Other sources pointed to U.S. Cyber Command as being the original source of the zero-day without providing any evidence.
Gaughen’s post on X claimed that the vulnerability related to the ‘Generate link previews’ feature, accessible through Settings → Chat, suggesting that everyone disables it to prevent becoming a victim. However, no further details about the alleged flaw, or other information about its exploitation were provided in that post.
Signal says claims unfounded
In a public service announcement published on X earlier today, Signal informed its userbase that after investigating the unfounded claims, it has found no actual information or evidence proving the existence of a zero-day relating to ‘Generate link previews.’
The platform also contacted people from USCYBERCOM, which was rumored to have more info on the subject, and received assurances that the agency holds no such info. Signal’s president, Meredith Whittaker, even went as far as characterizing the report as a typical example of a disinformation campaign, being purposefully vague while carrying enough clues to go viral.
Today, Gaughen deleted his original tweet about the zero-day vulnerability and posted an apology to his followers, saying that “the information he had been given earlier was false,” and there’s no zero-day on Signal relating to link previews.