Telegram's 'any message can be an app' feature turns messages into RCE
evilsocket · x · 2026-11-11
Security researcher v12sec shows that Telegram's newly launched 'any message can become an app' feature (Durov-touted: <4 KB, instant download, native rendering, built-in payments) means any Telegram message can now trigger remote code execution, with technical analysis posted. evilsocket amplified the finding.
More from Safety
- 35,000+ Grok-built apps exposed patient data, plaintext passwords, and sales pipeline — The Decoder · 2026-11-11
- Fortinet patches nearly 100 vulnerabilities after adding AI models to security testing — Potential-Couple-745 · 2026-11-11
- New BadEdit backdoors LLMs via model editing with just 15 samples, up to 100% success — terryyuezhuo · 2026-11-11
- Treat weights like code: undetectable malicious payloads in open models spark safety debate — DimitrisPapail · 2026-11-11
- Alice & Bob: ~25,000 cat qubits could factor RSA-2048 in 3 days, slashing prior estimates — AryHHAry · 2026-11-11
- Running local open-source models? Dormant-neuron backdoors mean you may have let the right one in — DimitrisPapail · 2026-11-11