Telegram Desktop Bug Deletes Up to 800 GB of User Data on Windows Due to Spellcheck Library Error
A dangerous configuration error in Telegram Desktop for Windows led to the recursive deletion of nearly 800 GB of user data stored in the C:\custom directory. Home users reported that executable files began disappearing while folder structures remained, gradually emptying entire project and application directories.
The root cause was traced to the lib_spellcheck library responsible for handling user-added dictionary words in a file named custom. Following changes in version 7.1.0, the Windows code passed an empty path string to the spellchecker; Qt then appended /custom, resolving it to the absolute path C:\custom. When the library encountered a directory instead of the expected dictionary file, it executed removeRecursively(), systematically deleting all accessible contents.
Analysis with Process Monitor confirmed that Telegram Desktop was opening the path, traversing subdirectories, and requesting deletion rights without any malicious intent or updater malfunction. The flaw was limited to Windows builds containing the integrated spellchecker and existed in versions 7.1.0 and 7.1.1 for approximately 66 hours.
The researcher virtual-anvil submitted detailed logs and opened ticket #31170. Developers acknowledged the issue, implemented fixes that ensure the path is validated before the function is called and that the library is blocked from operating on an empty address, and released the corrected build in Telegram Desktop 7.1.2. Affected Windows users are strongly recommended to update without delay.
Related articles
Docker Bypasses UFW Firewall Exposing PostgreSQL and Redis Ports to Rapid Malware Infections
A common Docker Compose setup with exposed database ports on fresh VPS instances allows attackers to compromise systems within minutes despite active UFW rules. Docker's use of DNAT rules in the PREROUTING chain and insertion of DOCKER-FORWARD chains before UFW rules in the FORWARD table routes external traffic directly to containers on internal bridge networks. IPv6 support in Docker versions 27 and later creates additional exposure vectors when administrators focus only on IPv4 protections or disable IPv6 filtering. Bots scan cloud IP ranges for open ports including 5432 and 6379, deploying miners such as kdevtmpfsi and kinsing or using Redis replication to load malicious modules. Historical cases include a Qdrant test instance on Hetzner compromised in under two minutes and similar issues reported in Spree Commerce starter templates. The article details Netfilter mechanics, protected-mode limitations in Redis, and specific exploitation techniques like CONFIG SET for cron jobs and CVE-2022-0543 Lua sandbox escapes.
WordPress 7.1.4 Addresses RCE in Update Process and Multiple Stored XSS Vulnerabilities
The WordPress development team released version 7.1.4 on October 28, 2026, as a security update to resolve several vulnerabilities. The most severe issue allows remote code execution during the software upgrade process. Multiple stored cross-site scripting flaws were also fixed, including those triggered by specially crafted block markup and manipulated privacy data deletion requests. No CVE identifiers were disclosed in the advisory. Site administrators are strongly urged to apply the update immediately to prevent potential exploitation. The announcement was reported by Security NEXT on November 2, 2026.
CISA Adds Two Ivanti Connect Secure Flaws to KEV Catalog After Confirmed Exploitation
US authorities have issued an alert after confirmed exploitation of two vulnerabilities in Ivanti Connect Secure (ICS). The flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were added to CISA’s Known Exploited Vulnerabilities Catalog on October 30, 2026. Attacks combining three vulnerabilities have also been observed in the wild. CVE-2026-111357 allows local authenticated attackers to escalate privileges due to missing authentication in a critical function. CVE-2026-118527 enables remote upload of arbitrary files to disk through predictable identifiers, even though authentication is required. The addition of CVE-2026-111357 was briefly withdrawn before being reinstated, highlighting administrative confusion around the listing.
Enodia: Open-Source Go Tool Automates Service Inventory, EOL Tracking and CVE Correlation
A DevOps engineer has released enodia, a single-binary Go CLI that discovers real versions of services across large heterogeneous environments and correlates them with end-of-life calendars and vulnerability databases. The tool was built after manual Ansible-based inventories and existing solutions such as endoflife.date, nvchecker, Renovate and Uptime Kuma proved insufficient for covering both infrastructure and application services while also providing actionable lifecycle, patch and branch status. Enodia uses product-specific probes for 123 technologies including PostgreSQL, MySQL, MariaDB, Jira, Confluence, Bitbucket, VMware vCenter, ESXi, pfSense and multiple Linux distributions, falling back to a generic URL-plus-regex probe when needed. Data collection is deliberately separated from evaluation so that inventory.jsonl files can be generated inside air-gapped networks and later analysed where CVE feeds are available. The project also contributed dozens of missing products and corrected EOL dates to the endoflife.date project and integrates both NVD and Russia’s FSTEC BDU vulnerability databases. Special handling was added for MySQL/MariaDB connection-error counters, version-string masquerading, and vendor-specific update nomenclature to avoid false reports.