Telegram Messenger LLP

New Capabilities

Fixed the flaw in version 7.2.9 without a security advisory; on October 12 said the risk was practically nil and that updated apps are safe.

A single clicked link could empty a Telegram Desktop account. The link slipped hidden commands into the app's local socket, which failed to escape the semicolon separating them. Those commands read files that together unlock the login and sent them to an attacker's chat.

Updated Oct 30