Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: None, CVEs: , Summary: A flaw in Telegram for Android could be chained with two other bugs to take full control of a victim's phone through a voice call, once the victim answered, according to security startup NebuSec. The attacker needed only an ordinary Telegram account. Telegram fixed the flaw in version 12.10.4 of the app, released in late September, and NebuSec disclosed it on October 29. Combined with an…
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Telegram. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The ZDI has assigned a CVSS rating of 7.0. The following CVEs are assigned: CVE-2026-111105.
Disponibile una Proof of Concept (PoC) per lo sfruttamento della CVE-2026-107181 - già sanata dal vendor - presente in Telegram Desktop, client desktop dell'omonima piattaforma di messaggistica.
Disponibile una Proof of Concept (PoC) per lo sfruttamento della CVE-2026-94488 - già sanata dal vendor - presente in Telegram Desktop, client desktop dell'omonima piattaforma di messaggistica. Tale vulnerabilità potrebbe consentire a un utente malintenzionato remoto di eludere i meccanismi di sicurezza sui sistemi interessati.
Group-IB analyzes Millenium RAT version 4.*, a remote access trojan that has undergone an architectural shift from .NET to native C++, while continuing to leverage the Telegram Bot API for command and control, requiring no dedicated server infrastructure. This blog also profiles the developer “ShinyEnigma”, and threat actor cluster “Y2K Operators” responsible for active Millenium RAT exploitation campaigns. Over 62,000 compromised endpoints across more than 160 countries have been identified,…