Search: “chat export”

14 items in the last 7d

ExPatch disclosed stored XSS in Telegram Desktop HTML export letting bot messages steal chat data when exports open in browsers.

ExPatch researchers Denis and Aleksander Rostilov found a stored XSS flaw (CVSS 8.2) where bot inline keyboard button text was written unescaped into HTML chat exports, executing attacker JavaScript in browsers. The payload can persist in chat history for months, exfiltrate messages, metadata, and local file paths, and rewrite the page, spreading via forwarded messages without bot membership. Telegram fixed it by applying SerializeString(), first stable fixed release 7.0.1 shipped July 14, 2026, but HTML exports created with vulnerable versions remain dangerous.

Security AffairsSep 15, 07:48 UTC · 2d agoVulnerability1· 1 read

Telegram Desktop XSS Vulnerability Lets Attackers Steal Entire Chat Histories

Stored XSS in Telegram Desktop HTML chat exports (CVSS 8.2) could let attacker-controlled inline keyboard buttons steal full chat histories.

ExPatch researchers Denis and Aleksander Rostilov found a stored XSS in Telegram Desktop's HTML chat export pipeline affecting builds before Beta 6.9.4 and Stable 7.0.1. Unsanitized inline keyboard button text becomes executable JavaScript when a user exports a chat and opens the HTML file in a browser, exposing messages, metadata, and local file paths, and enabling phishing overlays. Telegram patched the issue in commit 8457d13a during July 2026; no CVE had been assigned at disclosure time.

GBHackersSep 15, 10:11 UTC · 2d agoVulnerability

Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports

Telegram Desktop HTML export XSS (CVSS 8.2) let bot messages exfiltrate exported chats; fixed in 7.0.1 but old exports stay vulnerable.

ExPatch researchers found that Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 wrote bot inline-keyboard button text into HTML chat exports without escaping, allowing a bot to plant invisible JavaScript. When a user opened the export in a browser, the script could exfiltrate every message in that 1,000-message file, rewrite the displayed content, or fake a verification form. The flaw (rated CVSS 3.1 8.2) was fixed by commit 8457d13a in 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026), but pre-fix exports remain dangerous since updating the app does not fix old files. No CVE identifier or Telegram security advisory exists, and no exploitation in the wild is claimed.

The Hacker Newsupdated Sep 15, 09:47 UTC · 2d agofirst Sep 14, 17:58 UTC · 2d agoVulnerability 2 sources1

Telegram Desktop Flaw Lets Attackers Steal Chat Messages Through Poisoned HTML Exports

Telegram Desktop XSS in bot inline keyboard buttons let attackers steal chat content from exported HTML archives; patched in 7.0.1.

ExPatch researchers Denis and Aleksander Rostilov found a stored cross-site scripting flaw in Telegram Desktop's HTML export feature, present since version 4.15.1 (March 2024). JavaScript hidden in bot inline keyboard button text executes when a user opens an exported chat HTML file with JavaScript enabled, exposing messages, metadata, and enabling DOM manipulation such as fake verification screens. Fixes shipped in Desktop Beta 6.9.4 (July 3, 2026) and Stable 7.0.1 (July 14, 2026), but previously exported HTML files remain unsafe.

Cyber Security NewsSep 15, 09:47 UTC · 2d agoVulnerability 2 sources

Anthropic merges Claude Chat, Cowork, and more into a single product

Anthropic merged Claude Chat and Cowork into one product and launched Claude Docs and Slides for creating and exporting documents and presentations.

Anthropic is folding Claude Chat and Cowork into a single product where Claude automatically determines what a task needs, eliminating tab switching. It also introduced Claude Docs and Claude Slides for creating, editing, and exporting documents and presentations as PowerPoint or PDF, with Claude Design now integrated into conversations. The rollout starts with Pro and Max plans, followed by Team and Free tiers; enterprise admins receive at least 30 days' notice.

The Decoderupdated Sep 16, 18:09 UTC · 18h agofirst Sep 16, 16:31 UTC · 19h agoAI industry 5 sources1

Claude comes for Gemini with its own take on Docs and Slides

Anthropic launched Claude Docs and Slides in beta and merged chats with Cowork into 'one Claude', challenging Google's Gemini-powered productivity tools.

Claude Docs and Slides launch in beta, letting users create, edit, share, and collaboratively comment on documents and presentations from any chat, with export options. Anthropic also merged regular chats and Cowork into 'one Claude', bringing Cowork, Design, and Artifacts into a single interface. The update closes ground with Google, which has expanded Gemini inside Docs, Sheets, and Slides, and rolls out to Pro and Max users first across web, desktop, and mobile.

The Verge · AIupdated Sep 16, 18:09 UTC · 18h agofirst Sep 16, 16:30 UTC · 19h agoAI industry 5 sources

Anthropic merges Claude chat and Cowork in one interface

Anthropic unified Claude chat, Cowork, and Artifacts into one auto-routing interface, adding Docs and Slides creation with PDF and PowerPoint export.

Anthropic merged the Claude chat and Cowork front-ends so one window routes requests automatically, ending customer confusion over which tab to use. The update adds Claude Docs and Slides with PDF and PowerPoint export, collaborative sections, and comments, and makes Claude Design, launched in April, available anywhere in Claude. It rolls out to Pro and Max plans on web, desktop, and mobile over coming weeks, with Free and Team tiers later, following a recent Cowork memory upgrade.

TechCrunch · AIupdated Sep 16, 18:09 UTC · 18h agofirst Sep 16, 16:30 UTC · 19h agoAI industry 5 sources

WhatsApp Restricted Chat locks a conversation to your primary phone

WhatsApp is developing Restricted Chat, a per-chat setting blocking conversation sync to linked devices, defeating third-party clients and AI agents.

Restricted Chat, spotted in Android beta version 2.26.36.5 but not yet enabled, keeps a chosen conversation exclusively on the primary phone, out of reach of WhatsApp Web and linked secondary devices. It extends Advanced Chat Privacy controls: media is not auto-saved to gallery, export is blocked, and messages cannot be handed to Meta AI, with system messages notifying participants of changes. WhatsApp has not announced a release date.

Help Net SecuritySep 14, 08:08 UTC · 3d agoIndustry

Critical GitLab Flaws Let Attackers Read Arbitrary Files, Steal Credentials and Execute Code

GitLab issues emergency patches for critical path-traversal flaw CVE-2026-85706 (CVSS 10.0), GraphQL credential exposure CVE-2026-87719, and potential RCE flaw CVE-2026-88765.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing 18 vulnerabilities across Community and Enterprise Editions. CVE-2026-85706 allows unauthenticated arbitrary file reads via the repository commits API; CVE-2026-87719 exposes Advanced Search credentials through GraphQL subscription deserialization; CVE-2026-88765 may enable authenticated RCE via crafted project export imports. No exploitation was reported, but self-managed administrators are urged to upgrade immediately and review logs for suspicious API and GraphQL activity.

GBHackersSep 11, 10:13 UTC · 6d agoVulnerability CVE-2026-85706 CVE-2026-87719 CVE-2026-88765+15 CVEs1

GitLab Patches Critical Flaws Enabling Arbitrary File Read, Credential Theft and Remote Code Execution

GitLab patched a CVSS 10.0 path traversal (CVE-2026-85706) plus deserialization and buffer-overflow flaws, urging self-managed users to update immediately.

GitLab released versions 19.3.2, 19.2.6, and 19.1.8 on September 10, 2026, fixing CVE-2026-85706 (CVSS 10.0), an unauthenticated path traversal in the repository commits API enabling arbitrary file reads on both Community and Enterprise Editions. CVE-2026-87719 (CVSS 9.9) is insecure deserialization in the EE GraphQL subscription serializer that can expose Advanced Search configurations and credentials, while CVE-2026-88765 (CVSS 8.5) allows authenticated RCE via crafted project exports. The update includes database migrations, so single-node deployments will experience downtime; GitLab.com is already patched.

Cyber Security Newsupdated Sep 15, 00:52 UTC · 2d agofirst Sep 11, 08:20 UTC · 6d agoVulnerability 18 sources CVE-2026-85706 CVE-2026-87719 CVE-2026-887651

Slack can now vibe-code interactive charts and reports inside chats

Slack launched Slackforce Surfaces, letting Slackbot build interactive dashboards, reports, and microsites directly inside chat channels.

Slackforce Surfaces uses AI to gather context from conversations and connected apps such as Google Drive and Salesforce to generate shareable interactive reports, polls, dashboards, and presentations. Surfaces can be pinned to channels where colleagues can view, interact, and comment. The feature is available to all customers, including free users, with Slackbot enabled, and live data support starts in October.

The Verge · AISep 10, 21:25 UTC · 6d agoAI industry3

How much of F-Droid is LLM generated?

A FOSS maintainer manually graded 102 F-Droid apps from the September 12, 2026 update batch, finding many show signs of LLM-generated code.

A student and FOSS app maintainer reviewed 102 apps pushed to F-Droid on September 12, 2026, assigning each a three-tier rating for likelihood of LLM-authored code (mostly AI >50%, hard to say/mostly human, no signs of AI). The heuristic relies on commit aesthetics, README and branding style, and the presence of agentic infrastructure like Claude Code or Codex, which automatically places an app in the 'mostly AI' tier. Example ratings include Amber (Nostr event signer) as mostly AI, and Aria for Misskey as showing no AI signs. The author stresses reliable detection of LLM-generated code from text alone is impossible, so ratings are approximate.

Hacker News · AISep 15, 09:47 UTC · 2d agoAI research HN 46↑ · 23 comments

Introducing Meta One: A Subscription Service With More Features and AI to Create, Connect, and Stand Out

Meta launches global Meta One subscriptions bundling Instagram, Facebook, WhatsApp Plus with expanded Meta AI and Muse media generation, priced $2.99-$499 monthly.

Meta introduced Meta One, a global subscription service with plans for individuals, creators, and businesses, launching with more than 50 features across Instagram, Facebook, WhatsApp, and Meta AI. Individual bundles Core ($7.99/month) and Premium ($19.99/month) combine the single-product Plus plans with expanded use of compute-intensive AI capabilities, including image/video generation powered by Muse models and Instagram's Restyle. Business tiers range from Essential ($14.99/month) to Expert ($149/month) and Max ($499/month), with expansion planned to Edits, AI glasses, and more.

Meta NewsroomSep 15, 15:00 UTC · 1d agoAI industry

[AINews] Reality Checks on AI News (Yegge shuts down Gas Town, Databricks’ +60% Astra cost)

Latent Space AI news roundup: Steve Yegge shuts down Gas Town, Databricks reports 60% higher coding spend on GPT-6 Astra, OpenAI launches misalignment disclosure framework.

Latent Space's AI News digest for September 15-16, 2026 leads with Steve Yegge shutting down his Gas Town orchestrator despite spending thousands monthly on coding-agent subscriptions. Databricks rolled out GPT-6 Astra to roughly 3,500 engineers, reporting superior long-horizon performance over Opus 5 and Sol 5.6 but a ~60% increase in coding spend. OpenAI published a formal framework for disclosing model misalignment incidents with six case reports, while Microsoft and Google Research released safety papers on 'capability laundering' and the Fuse motive-inference benchmark. Xiaomi shared live RL training telemetry for MiMo-V2.6, estimated at $493k/day for the 1T-class Pro run.

Latent Space07:28 UTC · 4h agoAI industry 11 sources