Telegram's new widget engine has multiple RCEs; here's how to block it on macOS with Santa
banteg · x · 2026-11-13
banteg reports that Telegram's newly shipped bot widget engine already has multiple RCEs, with code execution demonstrated on Android, iOS and Windows. To get ahead of the inevitable macOS exploit, he published a mitigation: the native macOS Telegram client (13.2.0) runs bot-widget JavaScript in a separate XPC helper, so a Santa signing-ID rule can silently block 6N38VWS5BX:ru.keepcoder.Telegram.WidgetEngine while letting Telegram itself run. The gist covers Santa installation, Full Disk Access approval, verification via santactl fileinfo, fleet deployment with SIGNINGID + SILENTBLOCKLIST, and re-checking after Telegram updates.
More from Safety
- Running agents in VMs turns the threat internal, security researcher warns — wavefnx · 2026-11-13
- Nvidia CEO row framed as a coup: export-policy critics and closed-model vendors blamed — csuwildcat · 2026-11-13
- Korea's top tax exam scorer accused of wearing AI glasses — with zero evidence — meshive · 2026-11-13
- Cloudflare open-sources security-audit skill: multi-agent repo security audits, 71.5k stars — bibryam · 2026-11-13
- 10 open-source projects securing AI agent skills, as 26% of public skills show risky patterns — bibryam · 2026-11-13
- NY builds $55M lab to pre-test AI, UK seeks power to pull live systems by Nov 14 — YvesMulkers · 2026-11-13