Telegram Bug Floods iPhones with Fake Notifications, Causing Severe Overheating and Battery Drain
A persistent bug in the Telegram messaging app has been causing iOS devices to overheat dramatically and rapidly drain their batteries by spamming hundreds of false push notifications in the background.
The issue triggers constant English-language alerts reading "You have a new message" even when users have Russian language settings enabled and message previews turned off, rendering the notifications useless and filling the notification shade with chaos.
Reports of the problem first emerged in May but intensified after the release of Telegram version 12.9, which appears to create an infinite loop in background processes that overworks the CPU.
Affected users report battery losses of up to 11 percent within 30 minutes of idle time, with some devices becoming hot enough that Apple automatically pauses charging until temperatures drop.
One journalist even resorted to using a gaming controller with a built-in fan to keep an iPhone cool enough to charge during the ordeal.
Temporary Workaround
The only temporary workaround involves the following steps:
- Go to Telegram Settings → Data and Storage → Storage Usage and clear the cache.
- Ensure you have access to your password or recovery codes via email or other linked devices.
- Delete the Telegram app from the device.
- Reinstall it from the App Store and log back in.
While this approach helps many users, the bug has been known to return after one or two weeks for some, leaving the community waiting for a proper fix from the Telegram development team.
Related articles
SonicWall Global Management System Hit by Critical RCE and Path Traversal Vulnerabilities
SonicWall has disclosed six vulnerabilities in its SonicWall Global Management System (GMS) management product, with the highest-severity issues rated Critical. The most severe flaw, CVE-2026-66147, resides in the Dispatcher Service and allows unauthenticated remote code execution through crafted requests that inject commands. A second critical issue, CVE-2026-66145, stems from improper handling of zip archive extraction and enables path traversal attacks that can read sensitive data or write arbitrary files without authentication. Both vulnerabilities received CVSSv3 base scores above 9.0. The flaws affect both the virtual appliance and Windows versions of GMS. SonicWall released an advisory on August 11 urging immediate application of the available updates.
Adobe Issues Critical Security Updates for ColdFusion with Multiple High-Severity Vulnerabilities
Adobe has released security updates for Adobe ColdFusion to address 15 vulnerabilities disclosed in a security advisory on August 11, 2026. Among them, CVE-2026-48362 is an OS command injection flaw that allows arbitrary code execution and carries the maximum CVSSv3.1 base score of 10.0. Two additional issues, CVE-2026-48273 involving dynamic code evaluation and CVE-2026-71384 related to authorization bypass leading to denial of service, received scores of 9.9 and 9.6 respectively. Eight further vulnerabilities were rated Critical, prompting Adobe to urge immediate patching. The advisory highlights risks across multiple attack vectors and emphasizes rapid remediation to prevent potential exploitation.
Compromised SIM Cards Exploit Proactive SIM to Steal Files, Execute Code and Force 2G on Smartphones and IoT Devices
Researchers from the University of Birmingham and Fuzzware have demonstrated that a compromised SIM card can issue commands to smartphones and IoT devices by abusing the standard Proactive SIM feature. The attack leverages the RUN AT command to force the modem to execute AT commands, creating a direct channel from the SIM to the device hardware. Using their CATana toolkit, the team tested 18 smartphones and eight cellular IoT devices, finding the AT command interface exposed on two phones and seven IoT units. Four vulnerabilities were identified, enabling code execution, file theft, denial of service and persistent downgrade to 2G. Affected devices include the OPPO Reno14 F 5G and Quectel-based modules such as the EC25-AFX and EG25-G. Manufacturers have released some patches, and GSMA has registered the issue as CVD-2026-0122, though researchers recommend removing the RUN AT function entirely from firmware.
Russian Researchers Patent Detector Blinding Protection for Quantum Key Distribution Systems
Engineers from SFB Lab and the Center for Quantum Technologies at Moscow State University have developed a new method to protect quantum key distribution systems against detector blinding attacks. The technique not only detects the attack but also preserves the secure portion of the generated key instead of discarding the entire key after an alarm. The approach works by randomly varying the quantum efficiency of single-photon detectors at the receiver side, forcing an attacker to leave detectable traces such as erroneous or double clicks. These statistical anomalies allow the system to estimate the number of potentially compromised bits and remove them during privacy amplification. The solution has been granted Russian patent RU 2 856 208 C1 and accepted for publication in Physical Review Applied. It was validated on commercial off-the-shelf detectors and requires no changes to the optical scheme, making it compatible with a wide range of existing QKD hardware.