Tech & Leaks Zone
28 October 2026 19:41
Bottom display corners are now rounded!
Читать полностью…
Tech & Leaks Zone
28 October 2026 18:36
- Tandem OLED
- Touchscreen
- Dynamic Island
- P3 + Adobe RGB
- Base 24GB RAM and 1TB storage
- Powered by M5 Pro and M5 Max
Pricing starts from $2900 for M5 Pro powered 14” MacBook Pro
https://www.apple.com/macbook-pro/proled-xdr-display/
Читать полностью…
Tech & Leaks Zone
28 October 2026 14:41
Researcher Bypassed Telegram’s Server-Side Sticker Verification for a Zero-Click iOS Hack — Meanwhile, the Messenger Replaced the Vulnerable Library
Cybersecurity specialist Saifeldeen Aziz announced a talk at the OffensiveCon conference — the researcher spent a year studying the security of Telegram stickers. Telegram very recently overhauled its sticker library, so without further details, it remains unclear whether the updates have fixed the announced vulnerabilities.
There is likely no direct threat to Telegram users on the latest versions of the official apps right now.
What exactly did the researchers find?
• Using AI-driven fuzzing, the cybersecurity team found several vulnerabilities in the rlottie library, which is responsible for rendering animated stickers. In Telegram for iOS, this makes it possible to execute code on the victim’s device.
• Telegram relies on server-side verification to filter out malicious files.
• The researcher discovered logic flaws in how stickers are delivered and verified, using them to bypass the security mechanisms.
• According to the author, even after receiving the reports, Telegram continues to rely on server-side checks, while the vulnerable rendering code remains in the official clients.
Telegram replaced its sticker library
While the research was underway, Telegram changed its approach. The messenger published tlottie — a new sticker rendering library vibe-ported to Rust. It is already used in Telegram Desktop, Telegram for macOS, and Telegram for Android; since September, it has also been used in Telegram for iOS.
The tlottie library eliminates an entire class of memory bugs that have been used for sticker-based attacks for years. In the view of @ editors, by updating the library in client apps, the messenger’s team demonstrates that it does not rely solely on server-side checks in matters of security.
Are these findings still relevant?
• The presentation materials have not yet been published online. Which versions the exploit chain was tested on and the exact nature of the vulnerabilities will become known later.
• The research took a year, and the announcement specifically focuses on rlottie. Therefore, there is reason to doubt that the issue persists in the latest versions, although this still cannot be ruled out. Furthermore, logic flaws in sticker delivery and verification do not depend on the rendering library.
• Rust is no guarantee. There have been no independent audits or public analyses of tlottie yet, so the library will only be able to prove its quality over time.
A systemic problem
The history of sticker vulnerabilities goes back many years. Back in 2020, Shielder researchers discovered 13 bugs in rlottie that allowed for remote memory corruption on a device. At the time, Telegram only patched those specific errors.
Meanwhile, the company publicly denied the risks. In 2025, the exploit broker Operation Zero offered up to $4 million for zero-click exploits targeting the messenger, while a Telegram representative told Forbes that the messenger had “never been vulnerable to zero-click exploits”.
In March 2026, an entry regarding a vulnerability in Telegram stickers appeared in the Zero Day Initiative database. The messenger’s press service stated to Durov’s Code that “the existence of such an exploit is impossible” because all stickers are checked by servers. At the time, @ editors pointed out that server-side validation is merely one layer of protection that can itself contain errors — a conclusion supported by the findings of the new research. In October, ZDI published the full details of the vulnerability, marking it as unpatched.
In their announcement, Saifeldeen Aziz questions Telegram’s approach to security and speculates that such vulnerabilities could be used to create backdoors.
In the view of @ editors, the transition to tlottie is the first step in many years toward solving the underlying problem rather than applying another patch. Telegram often aggressively denies the possibility of any vulnerabilities or silences issues. @ editors note that trust is built not by such declarations, but by openly acknowledging problems and allowing independent code verification.
#vulnerabilities
Читать полностью…
Tech & Leaks Zone
28 October 2026 12:32
Geekerwan
https://youtu.be/gjUzH4UcSkw?
Читать полностью…
Tech & Leaks Zone
28 October 2026 08:54
Windows 10 Mobile S9 J7 edition 🪟🪟🪟🍷
Читать полностью…
Tech & Leaks Zone
28 October 2026 06:43
Apple really loves pissing off users
Читать полностью…
Tech & Leaks Zone
28 October 2026 00:13
BREAKING: Discord is opening your public server messages to Google Search Results
Discord has turned ON settings by default to let your messages appear on the web.
Full details:
https://www.notebookcheck.net/Discord-is-bringing-public-conversations-to-Google-with-AI-summaries-and-messages.1435424.0.html
Читать полностью…
Tech & Leaks Zone
27 October 2026 14:57
Qualcomm is the new MediaTek and vice-versa ?
Читать полностью…
Tech & Leaks Zone
27 October 2026 14:52
MediaTek: guess we winning now ?
Читать полностью…
Tech & Leaks Zone
27 October 2026 09:35
GitHub - AlphadogRSA/android-tv-debloat: Xiaomi Android TV debloat without root: reversible ADB cleanup, Claude and ChatGPT/Codex guides, FLauncher, DNS ad filtering and low-RAM settings.
https://github.com/AlphadogRSA/android-tv-debloat
https://redd.it/1xgmuos
@
Читать полностью…
Tech & Leaks Zone
27 October 2026 05:45
Mido server but portable
Читать полностью…
Tech & Leaks Zone
26 October 2026 15:04
Interactive HTML Messages Are Now Working in the Android App
A working prototype of the experimental HTMLBubbles technology is confirmed in the Beta version of Telegram for Android 13.2.
It makes it possible to create interactive messages built with HTML, CSS, and JavaScript that are displayed right in the chat without opening a separate Mini App. To test the feature, @ editors created their own HTML widget. Using it, they confirmed the execution of JavaScript and basic functions of regular websites.
Similar components were also found in the Beta version of Telegram for iOS 13.2, which now includes built-in tools for testing widgets as well.
Security concerns
So far, no dedicated toggle to disable HTMLBubbles has been found in the settings of the tested Beta versions.
Previously, @ editors expressed concerns about executing JavaScript right in the chat.
As a reminder, a vulnerability (CVE-2026-107181) was recently discovered in Telegram Desktop that allowed files to be stolen through specially crafted links.
Although that flaw is unrelated to HTMLBubbles, introducing a new mechanism for executing code inside messages could lead to much more severe vulnerabilities that require no user interaction to trigger (zero-click).
When will the feature be available to everyone?
For now, HTMLBubbles remains an experimental technology. The ability to send such messages is restricted, and a public API for developers has not yet been introduced.
#Android #iOS #beta
Читать полностью…
20017
