As infrequently as budget phones are updated, owners of low-cost phones should be glad their phone is continuing to receive support. However, a software update released on November 28th for the BLU Life One X2 has users less than thrilled. On first boot, the phone displays a new password screen—unfortunately, nobody has the password. Without a way to unlock the phone, users are resorting to factory resetting the phones with mixed results.
Multiple user reports on Reddit, iFixit, and Amazon have indicated that the affected phones crash on a screen in which you can enter your email address to receive updates from BLU. However, not all users appear to be affected by this bug—others have reported success after removing the microSD card. Additionally, given BLU's massive product portfolio (the company has released upward of 40 phones this year) and unintuitive naming scheme, it is somewhat unclear what models are affected. One Amazon user wrote a review indicating that the BLU Advance A7 was affected, while another user has posted about the Advance A5 at iFixit.
For now, not updating your firmware is advisable. This incident was foretold in 1999 by electronic oracles Eiffel 65, with their song "Blue (If I update, I die)."
This incident follows a tumultuous history for BLU Products. In November 2016, some Blu devices were identified by the security research firm Kryptowire as carrying spyware which transmitted user information to a Chinese company. As a result, sales of the BLU R1 HD were suspended for one month at Amazon. Amazon again pulled some Blu devices in July 2017 when the co-founder of Kryptowire claimed at Black Hat 2017 that the apps were still present on the phones, but that "They replaced [the malware] with nicer versions." Amazon restarted sales of the affected phones after a week. BLU has consistently denied responsibility for these vulnerabilities.
Android Police has reached out to BLU Products for a statement on this update situation. We'll let you know if we hear back from them.