Research 2 Telegram Desktop: one-click account takeover via IPC injection Oct 3, 2026 Webmin: one-click RCE via XSS Sep 26, 2026