July 2026
Published 2026-07-01
SEPP PRINS deployments stall; new IRSF vector via A2P
July's watch-list: half of announced 5G SA roaming pairs still ship TLS-only on N32-f, a new IRSF vector exploits A2P termination charging asymmetries, and the first ML-KEM migration profiles land in operator IMS testbeds.
SEPP N32-f: TLS-only remains the norm
5G
Field data across mid-2026 shows that of announced 5G SA roaming corridors, roughly half still run TLS-only on N32-f without PRINS/JWE. Sensitive IEs (SUPI, keys) remain visible to IPX intermediaries in those flows.
A2P termination-fee arbitrage revives IRSF
Fraud
Regulators in several EU markets have flagged a pattern of enterprise SMS aggregators originating apparently-legitimate A2P traffic to high-cost destinations, splitting revenue with grey-route operators. Traditional voice-IRSF detection misses the pattern.
ML-KEM lands in IMS testbeds
5G
Two tier-1 operators disclosed early integration of ML-KEM (Kyber) hybrid key exchange in IMS-AKA testbeds. Interoperability with legacy IMS clients remains the blocker.
GSMA FS.20 update: new GTP-U TEID validation category
Signaling
The next FS.20 revision adds a category for stateful TEID validation, closing a class of TEID hijack attacks that stateless GTP firewalls historically missed.