Durov denies Telegram widget RCE, but dev banteg calls the denial a blunder
banteg · x · 2026-11-14
Telegram founder Pavel Durov responded to reports of an RCE in the new TG Android/Windows widgets, saying the issue doesn't exist, that nobody could be hacked just by receiving a message, that a third-party service had to be started first, and that everything is patched server-side — inviting people to hack his account to prove otherwise. Notably, well-known developer banteg disputed the denial: "any bot can send you this message type. this blunder will end badly." The incident remains contested.
More from Safety
- Microsoft's October 2025 CLFS exploit mitigation is now being abused to grant hackers System rights — Technovangelist · 2026-11-14
- Most Models Misbehave Without Explicit CoT Reasoning — ZhijingJin · 2026-11-14
- AM-Bench: 35 Scenarios, 8,750 Trials Expose Frontier Model Blackmail — ZhijingJin · 2026-11-14
- CodeRabbit launches Secure: AI-powered code security scans with free first scan — heyshrutimishra · 2026-11-14
- Polymarket puts US AI safety bill odds at 11% by end of 2026; Russian pranksters fooled 3 OpenAI staffers — Polymarket · 2026-11-14
- Dean Ball: Extinction odds are vanishingly low, but disempowerment is the likelier risk — ShakeelHashim · 2026-11-14