https://beaksec.github.io/Cybersecurity from a different perspective 2026-10-07T16:24:19+02:00 beaksec https://beaksec.github.io/ Jekyll © 2026 beaksec /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-10-03T10:00:00+02:00 2026-10-07T16:21:55+02:00 https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/ beaksec

An unescaped separator in Telegram Desktop's single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.

2026-09-26T12:12:58+02:00 2026-09-26T12:12:58+02:00 https://beaksec.github.io/posts/webmin-one-click-rce-via-xss/ beaksec

A reflected XSS in Webmin chains to arbitrary command execution as root on a default install, from a single link. CVE-2026-49243.