beaksec

New Capabilities

Disclosed the flaw; published the technical writeup October 3, 2026

A single clicked link could empty a Telegram Desktop account. The link slipped hidden commands into the app's local socket, which failed to escape the semicolon separating them. Those commands read files that together unlock the login and sent them to an attacker's chat.

Updated Oct 30