Telegram Voice Call Flaw Allows Remote Code Execution on Android Devices
Security researchers disclosed a vulnerability in Telegram for Android that allows remote code execution on a victim's device after the user answers a voice call. The attacker needs only a regular account, with no special privileges required.
The flaw was present across versions 8.6.2 to 12.10.3, spanning releases from March 2022 through September 2026. Telegram issued the fix in version 12.10.4 at the end of September 2026. As of the disclosure on 29 October 2026, no CVE identifier had been assigned and no confirmed real-world attacks had been observed.
The root cause resides in the code that parses short messages exchanged between clients during a call. One such message, MediaState, reports microphone mute status, camera activation, and video rotation. The vulnerable implementation mishandled absent fields and read memory it should not have accessed.
According to The Hacker News, the defect is visible in the published source of version 12.10.3: when a rotation value is present, the code checks it and then reads the video state field even if that field is missing. Version 12.10.4 reads the rotation value from the correct field instead.
The underlying library fix was merged on 21 April 2026. It reached iOS in version 12.7 in May, the desktop application in 7.0.1 in July, and Android only in September. Researchers verified the issue solely on private calls running on ARM64 Android devices and found no indication that iOS, desktop, or group calls are affected.
No technical exploit analysis has been published, and the video demonstration does not disclose the exact versions used, so the link between the memory error and code execution rests on the researchers' report. Users should check the version number at the bottom of the Settings screen and update to 12.10.4 or later. Organizations managing corporate devices should inventory their fleet, as the affected range covers four and a half years of releases and devices without automatic updates remain exposed.
This issue is distinct from CVE-2026-111105, a separate 7.0-severity flaw in Telegram's animation library disclosed by the Zero Day Initiative.
Related articles
360 Security Cloud Opens PHP2Shell Vulnerability Self-Check Platform to Government and Enterprise Users
360 Security Cloud has launched a dedicated self-assessment platform that allows organizations to scan their PHP-based websites and systems for the PHP2Shell vulnerability. The service is now available to government agencies, large enterprises, and small-to-medium businesses. Users can apply by scanning a provided QR code to determine how many of their assets run PHP, identify affected versions, and check whether any systems have already been compromised. The platform addresses key questions about exposure: the number of PHP-powered sites and systems, the presence of vulnerable versions, and signs of prior intrusion. The announcement emphasizes that the tool helps organizations proactively assess risk without requiring external assistance. The original Chinese report was published on October 30, 2026, and the service is positioned as a practical response to ongoing PHP-related security concerns.
Liferay Community Edition Misconfiguration Exposes Plaintext Passwords in Government Systems via CWE-319
A detailed analysis reveals how the use of Liferay Community Edition in a closed government information system led to the transmission of user passwords in plaintext through transactional emails. The issue stemmed from default notification templates that included the [$PASSWORD$] macro, combined with unadjusted system variables pointing to localhost instead of the production domain. Despite proper OAuth 2.0 delegation and CSRF protections, the misconfigured password change workflow sent permanent credentials in clear text to user inboxes. The root cause was traced to custom portlets that incorrectly reused the New Password Notification trigger intended only for administrator-initiated resets. Remediation involves removing the password macro from email templates and updating portal-ext.properties to enforce production host settings. The case highlights how open-source enterprise platforms require thorough hardening beyond initial code audits when deployed in high-security environments.
GitLab Critical Vulnerabilities Traced to Ruby Onigmo Regex Engine, Including Exploited CVE-2026-97229
GitLab has disclosed that four critical vulnerabilities, including the already-exploited CVE-2026-97229, originate from flaws in the Ruby programming language's Onigmo regular expression engine rather than in GitLab code itself. The most severe issue, CVE-2026-97229, is an integer overflow in regex processing within CI/CD configuration files and carries a maximum CVSSv3.1 base score of 10.0. GitLab released patches on October 8, 2026, covering versions 19.4.2, 19.3.5, and 19.2.8. Ruby's development team followed with its own advisory on October 23, 2026, addressing the same underlying defects. The remaining three vulnerabilities involve double-free memory errors and additional integer overflows during regex parsing and compilation. Because the root cause lies in a shared dependency, any application or environment relying on the affected Ruby Onigmo engine may also be exposed.
CISA Adds Cisco Secure Firewall and GitLab Flaws to Known Exploited Vulnerabilities Catalog
US authorities have warned that two vulnerabilities in Cisco Systems firewall products and the GitLab development platform are being actively exploited in the wild. The Cybersecurity and Infrastructure Security Agency added CVE-2026-76418 and CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on October 29, 2026, urging immediate remediation. CVE-2026-76418 affects Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, allowing unauthenticated attackers to trigger device reboots and cause denial-of-service conditions. CVE-2026-97229 is an integer overflow in GitLab stemming from insufficient validation of regular expressions in CI/CD configurations, enabling remote code execution without authentication. CISA noted that the GitLab issue originates from a dependency in Ruby/Onigmo and may impact other products beyond GitLab itself. Organizations are advised to apply patches or mitigations without delay to prevent further exploitation.