{"vulnerability": "CVE-2026-107181", "sightings": [{"uuid": "446c77c8-06cd-4db7-8382-1bcc5c0479c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://www.acn.gov.it/portale/w/telegram-desktop-poc-pubblica-per-lo-sfruttamento-della-cve-2026-107181", "content": "", "creation_timestamp": "2026-10-07T09:08:02.000000Z"}, {"uuid": "e44808db-a621-4dd7-ac7f-90246bba4004", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxdlnzxpb32z", "content": "CVE-2026-107181\nVersions of Telegram Desktop older than 7.2.9 allow specially crafted tg:// links to trick the app into sending local files, including the files that store your login sessions. This could let an attacker take\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-10-08T04:10:04.896761Z"}, {"uuid": "1f00a57d-b023-4e9c-9d68-9c12a7efe81f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mxfvfl3vpb2f", "content": "A critical Telegram Desktop account takeover vulnerability (CVE-2026-107181) exposes users to session hijacking. Exploit details and PoC are now public.\n\n#Telegram #Cybersecurity #CVE2026107181 #AccountTakeover #PoC", "creation_timestamp": "2026-10-09T02:09:38.110290Z"}, {"uuid": "3b113bca-657a-49f5-9f35-42ba8e999d7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://t.me/tginfoen/2201", "content": "Dangerous vulnerability in Telegram Desktop: any file can be stolen with one click\n\nWhat you MUST NOT do and how to protect yourself:\n\u2022 Do not keep using versions earlier than 7.2.9 \u2014 update the client immediately. If you use an unofficial client, temporarily switch to the official one until an update is released.\n\nDownload:\n \u2022 Windows / macOS / Linux: official website or GitHub.\n \u2022 Windows: Microsoft Store.\n \u2022 macOS: App Store.\n \u2022 Linux: Flathub, Snapcraft.\n\nAdvice for users of older clients:\n\n\u2022 Links can be dangerous: whenever you click a link, read the pop-up window carefully \u2014 if Telegram shows an unusual structure in the link (for example, one starting with tg://), do not open it.\n\n\u2022 Do not use the client without a local passcode: enabling one encrypts the session files in the tdata directory, preventing immediate account hijacking even if those files are leaked.\n\nWhat is the issue?\n\nA vulnerability has been discovered in Telegram Desktop clients earlier than version 7.2.9 (CVE-2026-107181). Because the ; delimiter was not escaped, parameters in tg:// links were interpreted as separate IPC commands. Using the interpret: handler, an attacker could cause files from the system to be sent covertly to their channel, without the user\u2019s confirmation, when the user clicked a specially crafted link.\n\nThe main risk\n\nThe danger is not limited to stealing tdata session files and hijacking accounts. Exploiting the vulnerability makes it possible to covertly steal absolutely any files on the computer that the user can access: documents, saved browser sessions, SSH keys, system configurations, or cryptocurrency wallets.\n\n#security #desktop #vulnerabilities", "creation_timestamp": "2026-10-09T09:42:04.000000Z"}, {"uuid": "99d0767b-d336-4548-a5a1-cc2e10ebc8ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://bsky.app/profile/cryptonews-poster.bsky.social/post/3mxgpsmoahf2y", "content": "CRITICAL Telegram Desktop vulnerability (CVE-2026-107181) disclosed by BeakSec. Versions 7.2.8 & earlier affected. Attackers can exploit a link click in group chats to send local files. Account takeover possible if session file is also obtained & no local password is set. Fix in v7.2.9.", "creation_timestamp": "2026-10-09T10:02:13.021729Z"}, {"uuid": "298582b1-59b9-4df5-947b-f3431199bd65", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://t.me/package_security/2087", "content": "\u0412 Telegram Desktop (\u043a\u043b\u0438\u0435\u043d\u0442 \u0434\u043b\u044f \u041f\u041a-\u0432\u0435\u0440\u0441\u0438\u0438) \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\u0421\u043e\u0432\u0435\u0442\u0443\u044e \u0432\u0430\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 \u043d\u0435 \u043d\u0438\u0436\u0435 7.2.9. \u0415\u0441\u043b\u0438 \u0432\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0435 \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043b\u0438\u0435\u043d\u0442, \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043f\u0435\u0440\u0435\u0439\u0434\u0438\u0442\u0435 \u043d\u0430 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439, \u043f\u043e\u043a\u0430 \u043d\u0435 \u0432\u044b\u0439\u0434\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0421\u043a\u0430\u0447\u0430\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u0442\u0443\u0442:\n - Windows / macOS / Linux: \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0430\u0439\u0442 \u0438\u043b\u0438 GitHub.\n - Windows: Microsoft Store.\n - macOS: App Store.\n - Linux: Flathub,Snapcraft.\n\n\u0415\u0441\u043b\u0438 \u043d\u0435 \u043c\u043e\u0436\u0435\u0442\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f, \u0442\u043e \u0437\u043d\u0430\u0439\u0442\u0435:\n- \u0421\u0441\u044b\u043b\u043a\u0438 \u043e\u043f\u0430\u0441\u043d\u044b: \u043a\u043b\u0438\u043a\u0430\u044f \u043f\u043e \u043b\u044e\u0431\u044b\u043c \u0441\u0441\u044b\u043b\u043a\u0430\u043c, \u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0435\u0435 \u043e\u043a\u043d\u043e \u2013 \u0435\u0441\u043b\u0438 Telegram \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0432 \u0441\u0441\u044b\u043b\u043a\u0435 \u0441\u0442\u0440\u0430\u043d\u043d\u0443\u044e \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 tg://), \u043d\u0435 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442\u0435 \u043f\u043e \u043d\u0435\u0439.\n- \u041d\u0435 \u0434\u0435\u0440\u0436\u0438\u0442\u0435 \u043a\u043b\u0438\u0435\u043d\u0442 \u0431\u0435\u0437 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434-\u043f\u0430\u0440\u043e\u043b\u044f: \u0435\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0448\u0438\u0444\u0440\u0443\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441\u0435\u0441\u0441\u0438\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 tdata, \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u044f \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u044b\u0439 \u0437\u0430\u0445\u0432\u0430\u0442 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0430 \u0434\u0430\u0436\u0435 \u043f\u0440\u0438 \u0438\u0445 \u0443\u0442\u0435\u0447\u043a\u0435.\n\n\u041f\u0440\u043e \u0441\u0430\u043c\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u2013 \u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 Telegram Desktop \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.2.9 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-107181). \u0418\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u044f ; \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0432 \u0441\u0441\u044b\u043b\u043a\u0430\u0445 \u0441\u0445\u0435\u043c\u044b tg:// \u0440\u0430\u0441\u043f\u043e\u0437\u043d\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043a\u0430\u043a \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 IPC-\u043a\u043e\u043c\u0430\u043d\u0434\u044b. \u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 interpret: \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0433 \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443 \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u043d\u0430\u043b \u0431\u0435\u0437 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u043e\u043c \u0444\u0430\u0439\u043b\u043e\u0432 \u0441\u0435\u0441\u0441\u0438\u0438 tdata \u0438 \u0443\u0433\u043e\u043d\u043e\u043c \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043a\u0440\u044b\u0442\u043d\u043e \u0443\u043a\u0440\u0430\u0441\u0442\u044c \u0430\u0431\u0441\u043e\u043b\u044e\u0442\u043d\u043e \u043b\u044e\u0431\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0435\u0441\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f: \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b, \u0441\u043e\u0445\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0435 \u0441\u0435\u0441\u0441\u0438\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, SSH-\u043a\u043b\u044e\u0447\u0438, \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0438\u043b\u0438 \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0438 \u0441 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043e\u0439.\n\n\u26a1 \u041f\u0411 | \ud83d\ude0e \u0427\u0430\u0442 | \ud83d\udecd \u041f\u0440\u043e\u0435\u043a\u0442\u044b | \ud83d\udcf9 YT", "creation_timestamp": "2026-10-09T10:46:51.000000Z"}, {"uuid": "30d2cb49-f16d-4885-b7bc-29bf340ed755", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "published-proof-of-concept", "source": "https://t.me/package_security/2087", "content": "\u0412 Telegram Desktop (\u043a\u043b\u0438\u0435\u043d\u0442 \u0434\u043b\u044f \u041f\u041a-\u0432\u0435\u0440\u0441\u0438\u0438) \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\u0421\u043e\u0432\u0435\u0442\u0443\u044e \u0432\u0430\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 \u043d\u0435 \u043d\u0438\u0436\u0435 7.2.9. \u0415\u0441\u043b\u0438 \u0432\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0435 \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043b\u0438\u0435\u043d\u0442, \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043f\u0435\u0440\u0435\u0439\u0434\u0438\u0442\u0435 \u043d\u0430 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439, \u043f\u043e\u043a\u0430 \u043d\u0435 \u0432\u044b\u0439\u0434\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0421\u043a\u0430\u0447\u0430\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u0442\u0443\u0442:\n - Windows / macOS / Linux: \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0430\u0439\u0442 \u0438\u043b\u0438 GitHub.\n - Windows: Microsoft Store.\n - macOS: App Store.\n - Linux: Flathub,Snapcraft.\n\n\u0415\u0441\u043b\u0438 \u043d\u0435 \u043c\u043e\u0436\u0435\u0442\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f, \u0442\u043e \u0437\u043d\u0430\u0439\u0442\u0435:\n- \u0421\u0441\u044b\u043b\u043a\u0438 \u043e\u043f\u0430\u0441\u043d\u044b: \u043a\u043b\u0438\u043a\u0430\u044f \u043f\u043e \u043b\u044e\u0431\u044b\u043c \u0441\u0441\u044b\u043b\u043a\u0430\u043c, \u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0435\u0435 \u043e\u043a\u043d\u043e \u2013 \u0435\u0441\u043b\u0438 Telegram \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0432 \u0441\u0441\u044b\u043b\u043a\u0435 \u0441\u0442\u0440\u0430\u043d\u043d\u0443\u044e \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 tg://), \u043d\u0435 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442\u0435 \u043f\u043e \u043d\u0435\u0439.\n- \u041d\u0435 \u0434\u0435\u0440\u0436\u0438\u0442\u0435 \u043a\u043b\u0438\u0435\u043d\u0442 \u0431\u0435\u0437 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434-\u043f\u0430\u0440\u043e\u043b\u044f: \u0435\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0448\u0438\u0444\u0440\u0443\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441\u0435\u0441\u0441\u0438\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 tdata, \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u044f \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u044b\u0439 \u0437\u0430\u0445\u0432\u0430\u0442 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0430 \u0434\u0430\u0436\u0435 \u043f\u0440\u0438 \u0438\u0445 \u0443\u0442\u0435\u0447\u043a\u0435.\n\n\u041f\u0440\u043e \u0441\u0430\u043c\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u2013 \u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 Telegram Desktop \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.2.9 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-107181). \u0418\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u044f ; \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0432 \u0441\u0441\u044b\u043b\u043a\u0430\u0445 \u0441\u0445\u0435\u043c\u044b tg:// \u0440\u0430\u0441\u043f\u043e\u0437\u043d\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043a\u0430\u043a \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 IPC-\u043a\u043e\u043c\u0430\u043d\u0434\u044b. \u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 interpret: \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0433 \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443 \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u043d\u0430\u043b \u0431\u0435\u0437 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u043e\u043c \u0444\u0430\u0439\u043b\u043e\u0432 \u0441\u0435\u0441\u0441\u0438\u0438 tdata \u0438 \u0443\u0433\u043e\u043d\u043e\u043c \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043a\u0440\u044b\u0442\u043d\u043e \u0443\u043a\u0440\u0430\u0441\u0442\u044c \u0430\u0431\u0441\u043e\u043b\u044e\u0442\u043d\u043e \u043b\u044e\u0431\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0435\u0441\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f: \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b, \u0441\u043e\u0445\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0435 \u0441\u0435\u0441\u0441\u0438\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, SSH-\u043a\u043b\u044e\u0447\u0438, \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0438\u043b\u0438 \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0438 \u0441 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043e\u0439.\n\n\u26a1 \u041f\u0411 | \ud83d\ude0e \u0427\u0430\u0442 | \ud83d\udecd \u041f\u0440\u043e\u0435\u043a\u0442\u044b | \ud83d\udcf9 YT", "creation_timestamp": "2026-10-09T10:46:51.000000Z"}, {"uuid": "c6714f52-611d-4314-8ee4-79d8cc2b4c56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://t.me/tech_b0lt_Genona/7088", "content": "\u0412 Telegram Desktop (\u043a\u043b\u0438\u0435\u043d\u0442 \u0434\u043b\u044f \u041f\u041a-\u0432\u0435\u0440\u0441\u0438\u0438) \u043d\u0430\u0439\u0434\u0435\u043d\u0430 \u043e\u043f\u0430\u0441\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\n\n\u0421\u043e\u0432\u0435\u0442\u0443\u044e \u0432\u0430\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043b\u0438\u0435\u043d\u0442 \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 \u043d\u0435 \u043d\u0438\u0436\u0435 7.2.9. \u0415\u0441\u043b\u0438 \u0432\u044b \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0435 \u043d\u0435\u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u043a\u043b\u0438\u0435\u043d\u0442, \u0432\u0440\u0435\u043c\u0435\u043d\u043d\u043e \u043f\u0435\u0440\u0435\u0439\u0434\u0438\u0442\u0435 \u043d\u0430 \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439, \u043f\u043e\u043a\u0430 \u043d\u0435 \u0432\u044b\u0439\u0434\u0435\u0442 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435.\n\n\u0421\u043a\u0430\u0447\u0430\u0442\u044c \u043c\u043e\u0436\u043d\u043e \u0442\u0443\u0442:\n - Windows / macOS / Linux: \u043e\u0444\u0438\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0439 \u0441\u0430\u0439\u0442 \u0438\u043b\u0438 GitHub.\n - Windows: Microsoft Store.\n - macOS: App Store.\n - Linux: Flathub,Snapcraft.\n\n\u0415\u0441\u043b\u0438 \u043d\u0435 \u043c\u043e\u0436\u0435\u0442\u0435 \u0441\u0435\u0439\u0447\u0430\u0441 \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c\u0441\u044f, \u0442\u043e \u0437\u043d\u0430\u0439\u0442\u0435:\n- \u0421\u0441\u044b\u043b\u043a\u0438 \u043e\u043f\u0430\u0441\u043d\u044b: \u043a\u043b\u0438\u043a\u0430\u044f \u043f\u043e \u043b\u044e\u0431\u044b\u043c \u0441\u0441\u044b\u043b\u043a\u0430\u043c, \u0432\u043d\u0438\u043c\u0430\u0442\u0435\u043b\u044c\u043d\u043e \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432\u0441\u043f\u043b\u044b\u0432\u0430\u044e\u0449\u0435\u0435 \u043e\u043a\u043d\u043e \u2013 \u0435\u0441\u043b\u0438 Telegram \u043f\u043e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442 \u0432 \u0441\u0441\u044b\u043b\u043a\u0435 \u0441\u0442\u0440\u0430\u043d\u043d\u0443\u044e \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0443 (\u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442\u0441\u044f \u0441 tg://), \u043d\u0435 \u043f\u0435\u0440\u0435\u0445\u043e\u0434\u0438\u0442\u0435 \u043f\u043e \u043d\u0435\u0439.\n- \u041d\u0435 \u0434\u0435\u0440\u0436\u0438\u0442\u0435 \u043a\u043b\u0438\u0435\u043d\u0442 \u0431\u0435\u0437 \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434-\u043f\u0430\u0440\u043e\u043b\u044f: \u0435\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u0448\u0438\u0444\u0440\u0443\u0435\u0442 \u0444\u0430\u0439\u043b\u044b \u0441\u0435\u0441\u0441\u0438\u0438 \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 tdata, \u043f\u0440\u0435\u0434\u043e\u0442\u0432\u0440\u0430\u0449\u0430\u044f \u043c\u0433\u043d\u043e\u0432\u0435\u043d\u043d\u044b\u0439 \u0437\u0430\u0445\u0432\u0430\u0442 \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0430 \u0434\u0430\u0436\u0435 \u043f\u0440\u0438 \u0438\u0445 \u0443\u0442\u0435\u0447\u043a\u0435.\n\n\u041f\u0440\u043e \u0441\u0430\u043c\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u2013 \u0432 \u043a\u043b\u0438\u0435\u043d\u0442\u0430\u0445 Telegram Desktop \u0434\u043e \u0432\u0435\u0440\u0441\u0438\u0438 7.2.9 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c (CVE-2026-107181). \u0418\u0437-\u0437\u0430 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0440\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0440\u0430\u0437\u0434\u0435\u043b\u0438\u0442\u0435\u043b\u044f ; \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u0432 \u0441\u0441\u044b\u043b\u043a\u0430\u0445 \u0441\u0445\u0435\u043c\u044b tg:// \u0440\u0430\u0441\u043f\u043e\u0437\u043d\u0430\u0432\u0430\u043b\u0438\u0441\u044c \u043a\u0430\u043a \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u044b\u0435 IPC-\u043a\u043e\u043c\u0430\u043d\u0434\u044b. \u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0441\u043b\u0443\u0436\u0435\u0431\u043d\u043e\u0433\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430 interpret: \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0433 \u043f\u0440\u0438 \u043a\u043b\u0438\u043a\u0435 \u043d\u0430 \u043f\u043e\u0434\u0433\u043e\u0442\u043e\u0432\u043b\u0435\u043d\u043d\u0443\u044e \u0441\u0441\u044b\u043b\u043a\u0443 \u043d\u0435\u0437\u0430\u043c\u0435\u0442\u043d\u043e \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0444\u0430\u0439\u043b\u044b \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432 \u0441\u0432\u043e\u0439 \u043a\u0430\u043d\u0430\u043b \u0431\u0435\u0437 \u043f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0438\u044f \u0441\u043e \u0441\u0442\u043e\u0440\u043e\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f.\n\n\u041e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c \u043d\u0435 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0435\u0440\u0435\u0445\u0432\u0430\u0442\u043e\u043c \u0444\u0430\u0439\u043b\u043e\u0432 \u0441\u0435\u0441\u0441\u0438\u0438 tdata \u0438 \u0443\u0433\u043e\u043d\u043e\u043c \u0430\u043a\u043a\u0430\u0443\u043d\u0442\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043a\u0440\u044b\u0442\u043d\u043e \u0443\u043a\u0440\u0430\u0441\u0442\u044c \u0430\u0431\u0441\u043e\u043b\u044e\u0442\u043d\u043e \u043b\u044e\u0431\u044b\u0435 \u0444\u0430\u0439\u043b\u044b \u043d\u0430 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u0435, \u043a \u043a\u043e\u0442\u043e\u0440\u044b\u043c \u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0435\u0441\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f: \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u044b, \u0441\u043e\u0445\u0440\u0430\u043d\u0451\u043d\u043d\u044b\u0435 \u0441\u0435\u0441\u0441\u0438\u0438 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u043e\u0432, SSH-\u043a\u043b\u044e\u0447\u0438, \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0435 \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0438\u043b\u0438 \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0438 \u0441 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u043e\u0439.\n\n\u26a1 \u041f\u0411 | \ud83d\ude0e \u0427\u0430\u0442 | \ud83d\udecd \u041f\u0440\u043e\u0435\u043a\u0442\u044b | \ud83d\udcf9 YT", "creation_timestamp": "2026-10-09T11:33:13.000000Z"}, {"uuid": "f64dbd8e-bed0-4090-940f-a3b69906f33b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "published-proof-of-concept", "source": "https://t.me/HackingTeamGrupoOfficial/50073", "content": "CVE-2026-107181 Telegram Desktop  one-click account takeover via IPC injection\n*\nPOC + writeUP", "creation_timestamp": "2026-10-09T13:59:33.000000Z"}, {"uuid": "96835de6-aefc-468b-a6c1-11aa0b9d71f2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "published-proof-of-concept", "source": "https://t.me/proxy_bar/3649", "content": "CVE-2026-107181 Telegram Desktop  one-click account takeover via IPC injection\n*\nPOC + writeUP", "creation_timestamp": "2026-10-09T12:54:04.000000Z"}, {"uuid": "1348cb9a-e54a-4696-b6f2-b4def410d3da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://bsky.app/profile/dawson-barnett.sigmoid.social.ap.brid.gy/post/3mxhgxyykvc52", "content": "V Desktopu byla objevena chyba zabezpe\u010den\u00ed CVE-2026-107181: kv\u016fli chyb\u011bj\u00edc\u00edmu odd\u011blen\u00ed odd\u011blova\u010de byly parametry v odkazech sch\u00e9matu tg:/ rozpozn\u00e1v\u00e1ny jako samostatn\u00e9 p\u0159\u00edkazy IPC. Prost\u0159ednictv\u00edm servisn\u00edho handleru interpret: mohl \u00fato\u010dn\u00edk jedin\u00fdm", "creation_timestamp": "2026-10-09T16:56:53.755544Z"}, {"uuid": "89d4b10b-01bc-48b2-b4d5-fe05bb35dd2e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://bsky.app/profile/nube.at.app.wafrn.net/post/3mxhhebjuwu2q", "content": "Por cierto, si usan Telegram con regularidad en su versi\u00f3n desktop y est\u00e1s por debajo de la versi\u00f3n v7.2.9 deber\u00edan actualizar inmediatamente, hay una vulnerabilidad enorme en las versiones anteriores a esta versi\u00f3n\n\nhttps://www.cve.org/CVERecord?id=CVE-2026-107181 #telegram", "creation_timestamp": "2026-10-09T17:03:51.519904Z"}, {"uuid": "163761fb-5ed6-4ddf-9e7e-67418b6012cb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://infosec.exchange/users/DarkWebInformer/statuses/117413001329234001", "content": "\ud83d\udea8 PoC released for Telegram Desktop account takeover vulnerability; CVE-2026-107181\nhttps://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/\nA vulnerability in Telegram Desktop allows attackers to steal local files, including session keys, by tricking users into opening a specially crafted tg:// link.\nStolen session data could allow attackers to hijack Telegram accounts without knowing the victim's password.\nCVSS: 8.1 (High, v3.1) / 8.6 (High, v4.0)Affected: Telegram Desktop before 7.2.9Fixed: Version 7.2.9\nThe published PoC demonstrates how a malicious link can trigger file exfiltration through Telegram's IPC handler.", "creation_timestamp": "2026-10-09T21:10:21.197943Z"}, {"uuid": "bd13dc2d-ed3e-4c2e-84fb-894db8fbc7a6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-107181", "type": "seen", "source": "https://bsky.app/profile/thecybersecguru.com/post/3mxit7tgo522w", "content": "Critical Telegram Desktop Vulnerability (CVE-2026-107181): A Technical Analysis of One-Click Account Takeover via IPC\u00a0Injection\n\nTelegram Desktop CVE-2026-107181 enables one-click account takeover through IPC injection and\u2026\n\nhttps://thecybersecguru.com/exploits/telegram-desktop-cve-2026-107181/", "creation_timestamp": "2026-10-10T06:08:37.135966Z"}, {"uuid": "ea7814b0-c69d-44dc-a7f3-603246b091d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://bsky.app/profile/pmloik.bsky.social/post/3mxiyhiupch2b", "content": "Top 3 CVE for last 7 days:\nCVE-2026-21589: 78 interactions\nCVE-2026-88779: 47 interactions\nCVE-2026-102255: 16 interactions\n\n\nTop 3 CVE for yesterday:\nCVE-2026-102255: 9 interactions\nCVE-2026-107181: 4 interactions\nCVE-2026-107406: 4 interactions\n", "creation_timestamp": "2026-10-10T07:42:22.987910Z"}, {"uuid": "aee36baa-d9e4-47c7-a574-1edc26970cbf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://bsky.app/profile/raul.mastodon.in4matics.cat.ap.brid.gy/post/3mxixxwhmrql2", "content": "\u26a0\ufe0f Un clic en un enlla\u00e7 extern podia acabar amb el segrest de Telegram Desktop: una fallada IPC permetia llegir i exfiltrar fitxers locals. CVE-2026-107181; corregida a 7.2.9. Actualitza. #Telegram #Ciberseguretat https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/", "creation_timestamp": "2026-10-10T07:33:43.941125Z"}, {"uuid": "064a14ac-9684-4ad7-a3e1-c6d3f2f24536", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-107181", "type": "seen", "source": "https://bsky.app/profile/guruhitech.bsky.social/post/3mxjzbsfuyu2g", "content": "Telegram Desktop, falla di sicurezza: un clic pu\u00f2 rubare i file personali\n#chat #computer #messaggistica #sicurezza #telegram #truffa\n\ud83d\udd17 https://guruhitech.com/telegram-desktop-falla-sicurezza-file-personali-cve-2026-107181/", "creation_timestamp": "2026-10-10T17:29:45.473340Z"}, {"uuid": "7497bd5a-ad3b-4f0f-b031-2e246bd5cb38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3mxkeodekgv2n", "content": "\ud83e\udd16 CVE-2026-107181 (CVSS 8.1): Telegram Desktop's IPC fails to escape its ';' separator. A crafted tg:// link injects an OPEN: cmd reaching internal interpret: URI \u2192 arbitrary file read, session theft, ATO.\nhttps://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/", "creation_timestamp": "2026-10-10T20:53:36.514237Z"}, {"uuid": "11500644-3c1e-4dec-9abf-2a4116943738", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://t.me/ViralCyber/26659", "content": "\ud83d\udfe8\u06a9\u0634\u0641 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u062f\u0631 \u062a\u0644\u06af\u0631\u0627\u0645 \u062f\u0633\u06a9\u062a\u0627\u067e\u061b \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0648 \u062a\u0635\u0627\u062d\u0628 \u062d\u0633\u0627\u0628 \u06a9\u0627\u0631\u0628\u0631\u06cc \u062a\u0646\u0647\u0627 \u0628\u0627 \u06cc\u06a9 \u06a9\u0644\u06cc\u06a9!\n\u25c0\ufe0f\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0634\u062f\u062a \u0628\u0627\u0644\u0627 \u062f\u0631 \u0646\u0633\u062e\u0647 \u062f\u0633\u06a9\u062a\u0627\u067e \u062a\u0644\u06af\u0631\u0627\u0645 \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u062f\u0647\u062f \u062a\u0646\u0647\u0627 \u0628\u0627 \u0641\u0631\u06cc\u0628 \u06a9\u0627\u0631\u0628\u0631 \u0628\u0631\u0627\u06cc \u06a9\u0644\u06cc\u06a9 \u0631\u0648\u06cc \u06cc\u06a9 \u0644\u06cc\u0646\u06a9 \u0645\u062e\u0631\u0628\u060c \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0648 \u0627\u0637\u0644\u0627\u0639\u0627\u062a Session \u062a\u0644\u06af\u0631\u0627\u0645 \u0631\u0627 \u0633\u0631\u0642\u062a \u06a9\u0646\u0646\u062f.\n\n\ud83d\udd0e \u0645\u0634\u062e\u0635\u0627\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc:\n\u2b05\u0634\u0646\u0627\u0633\u0647: CVE-2026-107181\n\u2b05 \u0634\u062f\u062a: High\n\u2b05\u0627\u0645\u062a\u06cc\u0627\u0632 : 8.6\n\u2b05 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631: Telegram Desktop \u0642\u0628\u0644 \u0627\u0632 7.2.9\n\u2b05\u0648\u0636\u0639\u06cc\u062a: \u0627\u0646\u062a\u0634\u0627\u0631 \u0639\u0645\u0648\u0645\u06cc PoC \u0648 \u0627\u0631\u0627\u0626\u0647 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\n\n\ud83d\udea8 \u062e\u0637\u0631\u0646\u0627\u06a9\u200c\u062a\u0631\u06cc\u0646 \u067e\u06cc\u0627\u0645\u062f \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647\u060c \u0633\u0631\u0642\u062a \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0646\u0634\u0633\u062a (Session) \u062a\u0644\u06af\u0631\u0627\u0645 \u0648 \u062a\u0635\u0627\u062d\u0628 \u062d\u0633\u0627\u0628 \u06a9\u0627\u0631\u0628\u0631\u06cc (Account Takeover) \u0627\u0633\u062a\u061b \u0628\u0647\u200c\u0648\u06cc\u0698\u0647 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0631\u0645\u0632 \u062f\u0648\u0645 \u062a\u0644\u06af\u0631\u0627\u0645 \u0641\u0639\u0627\u0644 \u0646\u0628\u0627\u0634\u062f.\n\n\u2705 \u0636\u0631\u0648\u0631\u06cc \u0627\u0633\u062a Telegram Desktop \u0628\u0647 \u0646\u0633\u062e\u0647 7.2.9 \u06cc\u0627 \u0628\u0627\u0644\u0627\u062a\u0631 \u0627\u0631\u062a\u0642\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f.\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "creation_timestamp": "2026-10-10T19:35:36.000000Z"}, {"uuid": "11cae2df-c932-4e10-b8ba-7792c0102695", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "published-proof-of-concept", "source": "https://t.me/ViralCyber/26659", "content": "\ud83d\udfe8\u06a9\u0634\u0641 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u062e\u0637\u0631\u0646\u0627\u06a9 \u062f\u0631 \u062a\u0644\u06af\u0631\u0627\u0645 \u062f\u0633\u06a9\u062a\u0627\u067e\u061b \u0633\u0631\u0642\u062a \u0627\u0637\u0644\u0627\u0639\u0627\u062a \u0648 \u062a\u0635\u0627\u062d\u0628 \u062d\u0633\u0627\u0628 \u06a9\u0627\u0631\u0628\u0631\u06cc \u062a\u0646\u0647\u0627 \u0628\u0627 \u06cc\u06a9 \u06a9\u0644\u06cc\u06a9!\n\u25c0\ufe0f\u06cc\u06a9 \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc \u0628\u0627 \u0634\u062f\u062a \u0628\u0627\u0644\u0627 \u062f\u0631 \u0646\u0633\u062e\u0647 \u062f\u0633\u06a9\u062a\u0627\u067e \u062a\u0644\u06af\u0631\u0627\u0645 \u06a9\u0634\u0641 \u0634\u062f\u0647 \u0627\u0633\u062a \u06a9\u0647 \u0645\u06cc\u200c\u062a\u0648\u0627\u0646\u062f \u0628\u0647 \u0645\u0647\u0627\u062c\u0645\u0627\u0646 \u0627\u062c\u0627\u0632\u0647 \u062f\u0647\u062f \u062a\u0646\u0647\u0627 \u0628\u0627 \u0641\u0631\u06cc\u0628 \u06a9\u0627\u0631\u0628\u0631 \u0628\u0631\u0627\u06cc \u06a9\u0644\u06cc\u06a9 \u0631\u0648\u06cc \u06cc\u06a9 \u0644\u06cc\u0646\u06a9 \u0645\u062e\u0631\u0628\u060c \u0641\u0627\u06cc\u0644\u200c\u0647\u0627 \u0648 \u0627\u0637\u0644\u0627\u0639\u0627\u062a Session \u062a\u0644\u06af\u0631\u0627\u0645 \u0631\u0627 \u0633\u0631\u0642\u062a \u06a9\u0646\u0646\u062f.\n\n\ud83d\udd0e \u0645\u0634\u062e\u0635\u0627\u062a \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631\u06cc:\n\u2b05\u0634\u0646\u0627\u0633\u0647: CVE-2026-107181\n\u2b05 \u0634\u062f\u062a: High\n\u2b05\u0627\u0645\u062a\u06cc\u0627\u0632 : 8.6\n\u2b05 \u0646\u0633\u062e\u0647\u200c\u0647\u0627\u06cc \u0622\u0633\u06cc\u0628\u200c\u067e\u0630\u06cc\u0631: Telegram Desktop \u0642\u0628\u0644 \u0627\u0632 7.2.9\n\u2b05\u0648\u0636\u0639\u06cc\u062a: \u0627\u0646\u062a\u0634\u0627\u0631 \u0639\u0645\u0648\u0645\u06cc PoC \u0648 \u0627\u0631\u0627\u0626\u0647 \u0648\u0635\u0644\u0647 \u0627\u0645\u0646\u06cc\u062a\u06cc\n\n\ud83d\udea8 \u062e\u0637\u0631\u0646\u0627\u06a9\u200c\u062a\u0631\u06cc\u0646 \u067e\u06cc\u0627\u0645\u062f \u0627\u06cc\u0646 \u062d\u0645\u0644\u0647\u060c \u0633\u0631\u0642\u062a \u0641\u0627\u06cc\u0644\u200c\u0647\u0627\u06cc \u0646\u0634\u0633\u062a (Session) \u062a\u0644\u06af\u0631\u0627\u0645 \u0648 \u062a\u0635\u0627\u062d\u0628 \u062d\u0633\u0627\u0628 \u06a9\u0627\u0631\u0628\u0631\u06cc (Account Takeover) \u0627\u0633\u062a\u061b \u0628\u0647\u200c\u0648\u06cc\u0698\u0647 \u0632\u0645\u0627\u0646\u06cc \u06a9\u0647 \u0631\u0645\u0632 \u062f\u0648\u0645 \u062a\u0644\u06af\u0631\u0627\u0645 \u0641\u0639\u0627\u0644 \u0646\u0628\u0627\u0634\u062f.\n\n\u2705 \u0636\u0631\u0648\u0631\u06cc \u0627\u0633\u062a Telegram Desktop \u0628\u0647 \u0646\u0633\u062e\u0647 7.2.9 \u06cc\u0627 \u0628\u0627\u0644\u0627\u062a\u0631 \u0627\u0631\u062a\u0642\u0627 \u067e\u06cc\u062f\u0627 \u06a9\u0646\u062f.\n\n\ud83d\udcf1 @PingChannel \n\u062e\u0628\u0631\u060c \u062a\u062d\u0644\u06cc\u0644\u060c \u0627\u0646\u062a\u0642\u0627\u062f - \u0641\u0646\u0627\u0648\u0631\u06cc \u0627\u0637\u0644\u0627\u0639\u0627\u062a\n\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f\ud83c\udd70\ufe0f", "creation_timestamp": "2026-10-10T19:35:36.000000Z"}, {"uuid": "903ca76a-0889-4f5c-98d0-e2a9d7304962", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://t.me/RebootKanal/148", "content": "\ud83d\udff0\ud83d\udff0\ud83d\udff0 \n\nGef\u00e4hrliche Sicherheitsl\u00fccke in Telegram Desktop: Diebstahl beliebiger Dateien mit einem Klick \ud83d\udea8\ud83d\udd13\n\nWas Sie NICHT tun sollten und wie Sie sich sch\u00fctzen k\u00f6nnen: \ud83d\udee1\ufe0f\n\u2022 Bleiben Sie nicht bei Versionen unter 7.2.9 \u2013 aktualisieren Sie die App umgehend. Wenn Sie eine inoffizielle App verwenden, wechseln Sie vor\u00fcbergehend zur offiziellen Version, bis ein Update verf\u00fcgbar ist.\n\nDownload: \u2b07\ufe0f\n\u2022 Windows / macOS / Linux: offizielle Website oder GitHub.\n\u2022 Windows: Microsoft Store.\n\u2022 macOS: App Store.\n\u2022 Linux: Flathub, Snapcraft.\n\nTipp f\u00fcr Nutzer \u00e4lterer Versionen: \ud83d\udca1\n\n\u2022 Links sind gef\u00e4hrlich: Achten Sie beim Anklicken von Links genau auf das Pop-up-Fenster \u2013 wenn Telegram in einem Link eine ungew\u00f6hnliche Struktur anzeigt (z. B. beginnt mit \"tg://\"), klicken Sie nicht darauf.\n\n\u2022 Verwenden Sie einen lokalen Code-Passwort: \ud83d\udd11 Die Aktivierung verschl\u00fcsselt die Dateien der Sitzung im Verzeichnis tdata und verhindert so die sofortige \u00dcbernahme des Kontos, selbst wenn diese Dateien kompromittiert werden.\n\nWas ist das Problem? \u2753\n\nIn den Telegram Desktop-Apps bis zur Version 7.2.9 wurde eine Sicherheitsl\u00fccke (CVE-2026-107181) entdeckt. Aufgrund fehlender Maskierung des Trennzeichens ; wurden Parameter in Links mit dem Schema tg:// als separate IPC-Befehle interpretiert. Mit Hilfe eines speziellen Handlers interpret: konnte ein Angreifer beim Anklicken eines manipulierten Links unbemerkt Dateien vom System in seinen eigenen Kanal senden, ohne dass der Benutzer dies best\u00e4tigen musste.\n\nDas Hauptrisiko \u26a0\ufe0f\n\nDie Gefahr beschr\u00e4nkt sich nicht nur auf die \u00dcbernahme von Sitzungsdateien tdata und die Kompromittierung des Kontos. Die Ausnutzung erm\u00f6glicht es, absolut beliebige Dateien auf dem Computer im Hintergrund zu stehlen, auf die der Benutzer Zugriff hat: Dokumente, gespeicherte Browser-Sitzungen, SSH-Schl\u00fcssel, Systemkonfigurationen oder Wallets mit Kryptow\u00e4hrungen.\n\n#Sicherheit #Desktop #Sicherheitsl\u00fccken\n\n\ud83d\udff0\ud83d\udff0\ud83d\udff0", "creation_timestamp": "2026-10-09T10:48:56.000000Z"}, {"uuid": "bb857e4b-2f81-47f8-b04d-986eb8b03d7b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-107181", "type": "seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxlhr5nzfk2v", "content": "Vuln\u00e9rabilit\u00e9s \u00e9lev\u00e9es (7 \u2264 CVSS < 9) \u00b7 1\n\u2022 Telegram Desktop (CVE-2026-107181), CVSS 8.6 (Numerama)", "creation_timestamp": "2026-10-11T07:21:32.158222Z"}]}