beaksec

[beaksec @beaksec]

I found a one-click RCE as root in Webmin, CVE-2026-49243.

It shipped as 5.1 Medium and was rescored to 9.6 Critical today, so almost nobody has looked at it. An admin clicks a link, commands run as root.

Write-up and PoC:
https://t.co/gDDRmSJcLF

[beaksec @beaksec]

@blackorbird Thanks for sharing, fellow bird!

[beaksec @beaksec]

@zoecyber001 Thanks🙏

[beaksec @beaksec]

@moo9000 Agreed on the slop. And I feel for the triagers, the volume is unmanageable. But the same filter increasingly catches good research too: valid reports closed, no credit, bounties never paid. The result is the Nightmare Eclipse case. We need a new equilibrium.

[beaksec @beaksec]

@DanyAlos No. It relies on how the desktop app passes links between its own processes, which the web client doesn't do.

[beaksec @beaksec]

I found a one-click arbitrary file read in Telegram Desktop, CVE-2026-107181.

Coverage stops at the account takeover. That is real, but the session files are just one target among everything else you can read.

Write-up and PoC:
https://t.co/dg1EZ16rBK

[beaksec @beaksec]

@IntCyberDigest Beaksec here. Mitigations for anyone who can't update right away: https://t.co/qoWQ769iAF

[beaksec @beaksec]

@T3chFalcon Author here. Mitigations for anyone who can't update right away: https://t.co/qoWQ769iAF

[beaksec @beaksec]

@bpdbpd_no_mi @IntCyberDigest Author here. In practice: you get added to a group, the attacker's text files are already in that chat (possibly buried in the history, not next to the link), then a link arrives and you click it. Feasible against anyone being targeted.

Mitigations: https://t.co/qoWQ768KL7

[beaksec @beaksec]

@ThreatWire_ Author here. Thanks for the accurate summary. Full technical write-up with the code paths and the PoC: https://t.co/dg1EZ16rBK

[beaksec @beaksec]

@officer_secret Author of the write-up here. Thanks for sharing it 🙏

[beaksec @beaksec]

@Griffend0R Thanks for sharing, much appreciated 🙏

[beaksec @beaksec]

Hey, nobody 👋 Just landed on this platform.

Check out my work here: https://t.co/gP8q5lk3CR