In short: Researchers at Nanyang Technological University disclosed 84 previously unknown flaws in the software that runs 4G and 5G core networks — the part of the operator's infrastructure that routes your mobile data. In the worst case an attacker can hijack a session and quietly reroute a subscriber's traffic through themselves, opening the door to interception. 81 of the flaws already have CVE numbers. You cannot patch a carrier's network, but end-to-end encryption keeps the content of your traffic unreadable even if the pipe underneath is compromised.
What happened
A team from Nanyang Technological University (Singapore) reported 84 vulnerabilities across seven open-source implementations of mobile network cores, including Open5GS, free5GC, OpenAirInterface, SD-Core and eUPF. Developers have confirmed 83 of them and 81 received CVE identifiers. The flaws were found with an AI-assisted tool called iFinder, a multi-agent system built on large language models that cross-checked the code against the protocol specifications and refined proof-of-concept attacks automatically. The disclosure was published by The Hacker News on 31 July 2026 and covered by SecurityLab on 1 August 2026. Because this is a network-layer problem, the practical takeaway for users is the same one that applies to any untrusted network — the logic behind how a VPN works is what matters here.
How the traffic interception works
The bugs live in two control-plane protocols, GTP-C and PFCP, which internal network functions use to set up sessions and routing rules. In the headline scenario an attacker sends a forged PFCP Session Modification Request that reuses a victim's Packet Detection Rule with a higher priority, binding it to a malicious forwarding rule. The User Plane Function processes the attacker's rule first and redirects the victim's outbound data to the attacker instead of the internet — where it can be inspected, modified or dropped. The root cause is implicit trust: for decades the core's internal interfaces were assumed to be physically isolated and therefore trustworthy. As operators moved these functions into the cloud, that assumption broke, and researchers note the messages can sometimes be smuggled in remotely — tunnelled inside ordinary GTP-U traffic or introduced through a connected device.
Who is affected
These are flaws in the operator's core software, not in your phone, so there is nothing for a subscriber to "install" or fix directly. Confirmed CVEs include CVE-2026-8233 in Dotouch's XproUPF (CVSS 4.6, already patched), CVE-2026-36884 in OpenAirInterface's UPF and CVE-2025-66776 (session hijacking) in eUPF. Vendors are rolling out fixes and at least one major carrier is still remediating. Exploitation is not trivial — it needs access to internal interfaces or a foothold on the network — but the research shows that the mobile network you connect to should never be treated as an inherently private channel.
What this means for your data
The comfortable assumption that "the mobile network is safe by default" no longer holds. If someone can reroute your session, they sit on the path between you and the sites you use — the same position an attacker holds on a malicious Wi-Fi hotspot, just deeper inside the infrastructure. Modern sites use HTTPS, so page contents are usually encrypted, but an on-path attacker can still see which servers you reach, attempt downgrade tricks, and read anything that is not properly encrypted. This is why the defense is not "trust the network" but "add your own encryption on top of it," exactly as you would on mobile internet in general.
How to protect yourself
You cannot patch a carrier's core, but you can reduce what an interceptor gains:
- Encrypt the whole tunnel. A no-logs VPN wraps all your traffic in its own encrypted tunnel between your device and the VPN server. Even if a compromised core reroutes your session, the attacker sees one opaque stream to the VPN endpoint instead of the individual sites you visit — the destinations and contents stay hidden.
- Insist on HTTPS. Avoid sites that fall back to plain HTTP, and do not click through certificate warnings — those are exactly what an on-path attacker relies on.
- Keep your device updated. Client-side fixes and modern protocol defaults reduce the surface an interceptor can abuse.
- Be extra careful on unknown networks. The same mindset applies to public Wi-Fi; a VPN turns any untrusted link into a private one.
The lesson of this research is not that mobile networks are hopeless — it is that the pipe carrying your data is not guaranteed to be private, so your privacy should not depend on it. Encrypt your own traffic and the network's flaws stop being your problem. For more on staying private on the move, see the LiMP VPN blog and our plans.