RCQ Messenger Duress PIN Flaw Gave Full Access to Real Database on Android
Developers of the open-source messenger RCQ published a detailed post-mortem on flaws in their duress PIN implementation. The feature, also known as panic PIN or decoy code, is intended to let users unlock a harmless version of the app when forced to hand over their device.
Both Android and iOS versions encrypt the local message database. The database key, called dataKey, is stored encrypted with a value derived from the user’s PIN using PBKDF2-HMAC-SHA256 with 400 000 rounds plus a platform-protected pepper. Multiple slots exist for the real PIN, the decoy PIN, and a wipe PIN; each slot was supposed to carry its own payload.
On Android the decoy slot originally stored the identical dataKey used by the real account. Hiding the second account was performed only by an in-memory filter, leaving the real .db files untouched on disk. Entering the decoy code therefore decrypted the genuine conversation history, giving the impression of protection while actually exposing everything.
The root cause traced back to an early design decision to make the decoy mode appear as a second legitimate account sharing the same database. Later analysis showed that server-side correlation via push tokens, IP addresses, and device identifiers would immediately link the two accounts anyway, rendering the shared-key approach both dangerous and unnecessary.
The iOS version avoided the shared-key mistake but introduced its own problem: activating decoy mode cleared contacts and groups, producing an obviously empty application that itself became evidence of concealment. Notifications also bypassed the decoy filter on both platforms, potentially revealing real incoming messages.
After the review the team adopted the iOS cryptographic model across platforms. The decoy slot now holds an independent random key that opens only a separate decoy database. This database is populated with locally generated, realistically dated conversations chosen by the user. No real network requests are possible from decoy mode, eliminating server-side linkage. Legacy slots are marked and require manual re-creation of the decoy PIN.
On desktop the Tauri application uses Argon2id (64 MB memory, 3 passes) to derive a key that encrypts a vault containing both account secrets and message history with AES-256-GCM. The web version deliberately offers no PIN protection because any script in the same origin can read localStorage and IndexedDB.
Related articles
Citrix Issues Critical XenServer Patches for Host Compromise Vulnerabilities
Citrix published security bulletin CTX697256 on November 3, 2026, disclosing eight vulnerabilities affecting XenServer. The most severe issue, tracked as CVE-2026-98432 and rated critical, enables an unauthenticated attacker who reaches the management network to compromise the virtualization host and associated appliances. A second flaw, CVE-2026-102703, allows a privileged user inside a guest virtual machine to break out and take control of the underlying host, violating isolation guarantees. Six additional vulnerabilities impact network boot and secure boot processes, potentially allowing attackers to compromise VMs during startup or bypass code-signing policies. Affected products include XenServer 8.4 and 9 along with Workload Balancing and Conversion Manager appliances. Citrix recommends immediate application of the fixes and temporary isolation of the management network while updates are deployed.
Microsoft Paint Patch for CVE-2026-83844 Fails to Reach Some Windows 11 Users via Microsoft Store
Microsoft fixed a remote code execution vulnerability in the Paint application for Windows 11, but the update is not reaching all users through the Microsoft Store. The flaw, tracked as CVE-2026-83844, carries a CVSS score of 8.1 and involves an out-of-bounds memory read that could allow unauthenticated network attacks. Although exploitation is rated as highly complex, the issue is classified as important by Microsoft. The patch is delivered separately from Windows Update, requiring users to verify the Paint version manually in the Microsoft Store. The clean version is listed as 11.2609.401.0, yet multiple systems remain on 11.2603.251.0 despite automatic updates being enabled. Windows Latest reported the distribution problem after checking its own systems and collecting similar reports from administrators. No real-world exploitation of the vulnerability has been observed so far.
Mozilla Releases Firefox 159.0.1 to Patch High-Severity Layout Vulnerability CVE-2026-120572
Mozilla Foundation has issued Firefox 159.0.1 to address a high-severity vulnerability tracked as CVE-2026-120572. The flaw resides in the Layout: Block and Inline component responsible for web page rendering. It stems from improper handling of boundary conditions during layout processing. CISA assigned the issue a CVSSv3.1 base score of 8.8, confirming high impact. The update was published on November 3, 2026, and is rated high severity by both Mozilla and CISA. Users are advised to apply the patch immediately to mitigate potential exploitation risks.
WatchGuard AuthPoint Authentication Gateway Hit by Four Critical Vulnerabilities
WatchGuard disclosed four security advisories for its AuthPoint multi-factor authentication solution on November 4, 2026. Three of the issues received a Critical rating while one was rated High. The flaws reside in the AuthPoint Authentication Gateway component and affect environments integrated with LDAP and Active Directory. CVE-2026-121639 allows unauthenticated attackers to disrupt authentication services or delete directory synchronization settings over the network. The remaining three vulnerabilities enable man-in-the-middle attacks, capture-replay actions, and forged authentication results. No exploitation in the wild has been observed. WatchGuard has released updated versions to address all reported issues.