Security
GitLab patches CVE-2026-97229, Telegram fixes one-click takeover
GitLab rushes a max-severity RCE fix, Telegram closes a one-click account takeover, and Bitdefender finds malware baked into budget phones.
This edition was produced with artificial intelligence. Text and voice are generated automatically.
GitLab urges immediate patching of maximum-severity RCE flaw
GitLab warned users to immediately patch a maximum-severity vulnerability in its CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code on targeted instances. Tracked as CVE-2026-97229, the integer overflow flaw was found by researcher joaxcar via GitLab’s HackerOne bug bounty program. Under certain conditions, an unauthenticated user could execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration, due to insufficient validation. Fixes landed in Community and Enterprise Edition versions 19.2.8, 19.3.4 and 19.4.2; GitLab strongly recommended all self-managed installations upgrade immediately. GitLab.com already runs the patched version, and GitLab Dedicated customers need no action.
GitLab warns of max severity code execution vulnerability →
Topics: Patch Tuesday & security updates
Telegram Desktop 7.2.9 fixes one-click account takeover chain
Telegram Desktop through 7.2.8 carried two chained defects enabling one-click account takeover, tracked as CVE-2026-107181 and rated 8.1 High, confirmed on Windows 6.9.3. The app registers the tg: URI scheme and forwards clicked links to a running instance over a local socket as serialized text, with the separator never escaped; a crafted link containing a semicolon is treated as one URL by the new process but split into multiple instructions by the running instance, allowing command injection. The OPEN: command reaches the internal interpret: scheme, which reads a file named in an instruction file and sends it to a chat with no authorization check or confirmation. Attackers place instruction files on disk via auto-downloaded group attachments. Fixed in 7.2.9 on 16 September 2026; the changelog mentioned only a rendering fix.
Telegram Desktop: one-click account takeover via IPC injection | beaksec →
Topics: Patch Tuesday & security updates
Google pays $90,000 for DevSite RCE via forgeable Flask sessions
A remote code execution flaw in Google’s shared DevSite platform earned a $90,000 bounty after researcher Simon Koeck mapped the OAuth flow used across Google’s developer documentation sites. A request to /oauth2authorize set a roughly 1,200-byte Flask session cookie; decoding its zlib-compressed payload exposed a pickle-serialized OAuth2WebServerFlow object containing Google’s OAuth client_id and a live client_secret in plaintext. That same secret served as the Flask SECRET_KEY, so re-signing a forged payload was accepted, and the OAuth callback calls pickle.loads on the session flow, yielding unauthenticated RCE. Because DevSite is shared, the key from developers.google.com signed valid sessions on firebase.google.com, developer.android.com and source.android.com. Reported Aug 6, 2026; fixed Oct 7, 2026.
How I Found a $90,000 Remote Code Execution Vulnerability in Google | Simon Koeck →
Topics: Google
Bitdefender finds firmware-level malware on budget Android phones
Bitdefender researchers found an unidentified threat actor compromised the supply chain of multiple smartphone manufacturers, adding malware at the firmware level before devices shipped to stores. Named brands include the Doogee S200 X, Doogee Fire 3 Max and Cubot KINGKONG X, Chinese makers of budget rugged Android phones; ripoff devices impersonating Samsung and Apple were also mentioned. Affected devices generally use MediaTek chipsets, infected so attackers could tamper with apps, gain higher privileges and run remote code execution without the victim’s knowledge. Bitdefender claims thousands of victims across roughly 150 countries, with the highest concentration in Mexico, France, Italy, the United States, Germany, Brazil and Spain. It uncovered 32 malicious apps, including fake weather apps, file managers, app lockers, OCR tools and audio editors, that create invisible overlays and register ads as viewed to defraud ad networks. One app locker contained a TCP proxy registering phones with a remote command server, enabling a residential proxy service. Removal often requires firmware-level cleanup or Android Debug Bridge.
Experts warn cheap Android phones are being shipped with malware built in, so be on your guard →
Topics: Supply chain attacksMalware & infostealers
Phishing campaign abuses Power BI dashboards to deliver ScreenConnect
Security researchers Huntress uncovered a phishing campaign that abused publicly accessible Microsoft Power BI dashboards to trick victims into downloading ScreenConnect remote monitoring and management software. The campaign began on or around September 10, 2026. Attackers created a public dashboard, likely using a throwaway or compromised Microsoft account, designed to look like a blurred document with a button labeled Download Reference. Clicking it redirected victims to an attacker-controlled site outside Microsoft’s infrastructure, where an automatic ScreenConnect download launched. Because emails linked to a legitimate Microsoft service, they likely evaded at least some email filters. After deploying one ScreenConnect instance, attackers added a second and configured a scheduled task to repeatedly run a PowerShell script; in one incident they deleted the first instance, possibly to preserve access. Huntress stopped the attack before it progressed beyond remote access, so the end goal is unknown.