Telegram Desktop HTML Export Flaw Allowed Stealthy JavaScript Injection into Chat History
Researchers from ExPatch have disclosed a vulnerability in the desktop version of Telegram that allowed stealthy injection of JavaScript into exported chat histories. The flaw enabled attackers to embed malicious scripts within HTML exports without altering the visible appearance of messages inside the messenger itself.
The root cause lay in how Telegram Desktop handled button captions placed by bots beneath messages. While the application properly escaped dangerous characters in message text, sender names, and other fields, it failed to sanitize the text labels on inline buttons. Attackers could hide scripts using invisible characters, and the button-based payload persisted even after messages were forwarded between chats.
Once a user performed an HTML export in a vulnerable version, the script would execute automatically upon opening the file in any browser with JavaScript enabled. The code could copy conversation contents to a remote server or replace the displayed history with fake content such as a phishing form mimicking Telegram verification. Because large exports are split into separate files of one thousand messages each, the entire account remained protected, but individual chat segments were exposed.
The vulnerability existed in versions ranging from 4.15.1 to 6.9.3. A fix was included in beta release 6.9.4 and the stable version 7.0.1 published on July 14. Importantly, the patch does not retroactively secure previously generated HTML files, prompting researchers to recommend re-exporting old chats after updating or viewing legacy exports with JavaScript disabled.
No confirmed cases of real-world exploitation have been reported. The attack required three simultaneous conditions: use of a vulnerable Telegram Desktop version for export, presence of a malicious bot message in the exported chat, and opening the resulting HTML file in a browser with active scripting.
Related articles
Critical MikroTik RouterOS Vulnerabilities Enable SSH Authentication Bypass and Privilege Escalation
Polish CERT disclosed three vulnerabilities in MikroTik routers, two of which have been actively exploited since at least September 2. The flaws, rated 9.2 on CVSS, affect devices with internet-facing SSH access and were discovered using OpenAI models GPT 5.5 Cyber and GPT 5.6 Sol followed by manual verification. CVE-2026-67276 allows authentication bypass when the attacker knows the username and public key module, while CVE-2026-86060 permits privilege escalation via usernames containing invalid characters. Their combination enables full device compromise. A third issue, CVE-2026-67277 rated 8.8, resides in the speed-test service and can cause denial of service. Patches are available in RouterOS versions 7.25beta3, 7.24.2, 7.23.4 and 6.49.21, and MikroTik added detection for prior compromise. Attacks began concurrently with patch release and leave distinctive log entries.
Yookassa Webhook Flaw Allowed Forging Payment Confirmations via Single Curl Request
A technical audit of a car rental service uncovered a critical flaw in the Yookassa webhook handler where payment.succeeded events were trusted without verification. The endpoint accepted the event type and gateway_payment_id directly from the client-supplied payload, enabling attackers to mark pending bookings as paid using a simple unauthenticated POST request. The vulnerability existed because the integration did not use Yookassa's optional Webhook-Signature mechanism and avoided IP allowlisting due to proxy infrastructure concerns. Developers addressed the issue by implementing a reverse API call to fetch authoritative payment status from Yookassa before updating records, ensuring fail-closed behavior on errors. New tests cover forgery attempts, amount mismatches, and idempotency, while several additional hardening measures were deliberately deferred to keep the patch minimal and reviewable. The original unit tests had masked the problem by simulating trusted input rather than validating source authenticity.
Password Deleted from Git but Still Present: Major CI/CD Security Mistakes
Developers often leave secrets in configuration files, .env examples, or test scripts that end up in Git history. Removing a file in a new commit does not erase previous versions, and .gitignore offers no protection for already tracked content. Pre-commit hooks with tools like Gitleaks can scan staged changes before they reach the repository. Docker images can retain secrets in layers even after removal commands, requiring BuildKit secret mounts instead. Terraform plans and state files may still expose sensitive values marked only as sensitive. Kubernetes workloads need both non-root containers with dropped capabilities and narrowly scoped RBAC roles. Multiple scanning stages from pre-commit through post-deployment help catch issues before they reach production.
Critical SSRF Vulnerability in AWS SSM Agent Allows IAM Credential Theft via Port Forwarding Bypass
Amazon Web Services has disclosed a high-severity server-side request forgery vulnerability in the AWS Systems Manager Agent. The flaw, tracked as CVE-2026-89049, affects the port forwarding feature used by Session Manager and stems from insufficient validation that permits bypass of deny-list restrictions on link-local addresses. Successful exploitation requires port-forwarding permissions but can lead to unauthorized access to instance metadata and temporary IAM role credentials. The company rated the issue as Important with CVSSv4.0 base score 8.5 and CVSSv3.1 score 9.9. The vulnerability was addressed in version 3.3.4851.0 released on 13 July 2026, prior to the public advisory issued on 10 September 2026.