Telegram Zero-Click Vulnerabilities: LLM-Driven Fuzzing Chains Flaws for Code Execution
jedisct1 · x · 2026-10-29
A year-long independent study presented at OffensiveCon shows LLM-orchestrated fuzzing of Telegram's rlottie sticker library uncovered multiple memory-corruption bugs (initial CVSS 9.8), plus logic flaws chaining around server-side mitigations to achieve code execution on iOS. The researcher questions whether Telegram's server-controlled zero-click reachability model is a mitigation, an architectural risk, or closer to a backdoor.
More from Safety
- LMArena pushes independent model behavior evaluation for agentic workflows — pxd · 2026-10-29
- ChatGPT promised a suicidal man human help was coming six times — none existed — TobyWalsh · 2026-10-29
- Open-Source extensible-mcp Adds Zero-Trust Policy Control to LLM Tool Calls — Fearless-Might-5439 · 2026-10-29
- Lightspeed survey: 79% of CISOs hit by AI incidents, hijacked agents top threat — annetgriffin · 2026-10-29
- NIDO's offline AI assistant won't guess emergency numbers — it answers from verified facts — NIDO_007 · 2026-10-29
- Does ComfyUI's built-in OpenRouter node enforce ZDR for Grok 4.5 requests? — ApprehensiveTruck923 · 2026-10-29