[telegram]

October 29, 2026

• Telegram's rlottie animation library got a ZDI 0-day advisory — CVE-2026-111105 (CVSS 7.0), an out-of-bounds write before an allocated buffer from attacker-controlled animation data, disclosed unresolved at the client-code level. Telegram responded that the flaw is in rLottie itself, so potentially any app using it, and that it is already fixed in their tLottie fork (@DarkWebInformer, @telegram). · Vulnerabilities & Exploits
• Yoba lures victims to fake GitHub "AI desktop app" repos and sideloads DLLs via signed ChatGPT and Claude binaries, with anti-analysis checks and a Telegram/DGA plus DoH C2 chain (Ed25519-signed, AES-encrypted) that currently drops XMRig but is a generic loader (Check Point). Separately, a Chinese-speaking actor is SEO-poisoning DeepSeek download searches to deliver Kong RAT through a multi-stage chain (Hybrid Analysis). · Threat Activity

in Exploit Chains Built by Hand, by Botnet, and by Model

October 10, 2026

• Telegram Desktop one-click account takeover (CVE-2026-107181) has a public PoC. A crafted tg:// link abuses the IPC handler to exfiltrate local files including session keys, enabling account hijack without the password; fixed in 7.2.9 (beaksec), with Chinese researchers reporting successful reproduction (write-up). · Public Exploits & Vulnerability Research

in Fake "Security Audit" Workflows Sweep GitHub for Cloud and AI Keys

June 29, 2026

Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week

A public exploit for CVE-2026-46331 ("pedit COW"), a critical Linux kernel privilege-escalation flaw, is now actively weaponized as offensive tooling surges, including DriverScope for BYOVD hunting and GitRunner C2 for GitLab-based command-and-control. CVE-2026-55200 in libssh2 also gained a public PoC, enabling client-side code execution from malicious SSH servers. Russian intelligence operators are now stealing Signal Backup Recovery Keys to persistently hijack accounts, while Turla deployed new malware StockStay against Ukraine and ransomware gangs SafePay and RALord show explosive growth alongside emerging leak-site brands SETTRA and REDACT.