[falsedan]

There's a lot of woo in the press release, but the essense is: they claim to have found an exploit in the SIM Application Toolkit (specifically, in the S@T Browser [SIMalliance Toolbox Browser]), which can be triggered when the SIM processes a SMS which contains some attacker data as a payload, and results in the payload being executed by the SIM. The SIM can request some details from the phone (like Cell ID (rough location) and IMEI) and exfiltrate them (via another SMS).

The SIM Application Toolkit is fairly low-level, so has access to a few other functions, like making calls or opening applications or updating firmware. Whether these functions are permitted by the phone depends on the manufacturer, but they claim that the Cell ID & IMEI functions are widely-supported.