Signal’s security flaw was patched in September 2019, and the rest of the messaging apps were fixed more recently in the second half of 2020. The Project Zero researcher also looked at other popular messaging apps such as Telegram and Viber, but she could not find these particular security flaws. She looked at Telegram in August 2020, and Viber was investigated in November last year. Back in November 2018, the very same researcher brought to daylight a similar loophole in WhatsApp – it was affecting not only Android users, but the security flaw was observed on Apple devices too.
Containing Machine Speed Cyber Attacks Inside Ai Infrastructure
Telegram fixed the vulnerable code in commit 8457d13a by applying the same HTML sanitization already used elsewhere in the export process. The researchers say the fix first appeared in Telegram Desktop Beta 6.9.4 on July 3 and stable version 7.0.1 on July 14. A victim must create an HTML export using a vulnerable Telegram Desktop version, the malicious message must be included in that export, and the victim must then open the resulting file in a browser. The flaw was fixed in July, roughly two months before its public disclosure, but HTML exports created with older vulnerable versions may remain dangerous even after Telegram Desktop is updated.
The changes described below will allow us to focus on the most critical CVEs while being transparent about how we are managing our current workload. They will also allow us to stabilize the program while we develop the automated systems and workflow enhancements required for long-term sustainability. New risk-based model will allow NIST to manage current CVE volume while modernizing the NVD for long-term sustainability. Developers integrating with the NVD APIs are encouraged to review the updated NVD Vulnerabilities API and schema documentation on the NVD Developer Vulnerabilities Page. Starting August 26th, 2026, the entries will not include the affected data but will contain a GitHub Link (a direct URL to the CVE record on GitHub). The NVD’s new model keeps the current CVE detail endpoint (/cves/) unchanged; it still returns the latest full “affected” JSON for a given CVE (the /cvehistory feed changes).
Hackers Using New Sophisticated Imessage 0-click Exploit To Attack Iphone Users
We have prepatch protection as well or or defend rules to detect ex… Active exploitation of these vulnerabilities even before those patches were available. So all of that is is available for you if you have the right updates enabled on the on the box… On the on the platform. The Onapsis Research Labs goes over a threat advisory on the newly released SAPMAP Exploitation Toolkit containing the latest threat insights and protection guidance. The discovery, made by cybersecurity firm iVerify, reveals how attackers could compromise iPhones without any user interaction by exploiting a flaw in iMessage’s contact profile update feature.
The attack becomes particularly dangerous because modern IM clients automatically parse rich media content, making the exploitation completely transparent to victims. These trends turned messaging apps into critical digital infrastructure, making their protection as vital as corporate networks. Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud. By indexing some test websites to Bing, we were able to extract their static tracking links and use them to bypass the url_safe check, allowing our links to be fully rendered. The Bing tracking links cannot be altered, so a single link cannot extract information that we did not know in advance. Our solution was to index a page for every letter in the alphabet and then use those links to exfiltrate information one letter at a time.
Hackers then listened quietly and, in some cases, even turned the camera on without alerting the owner of the targeted device. Many less popular applications have not been researched, and it is currently unknown if this security fault could be observed there. In terms of the Onapsis platform support, you have support, through Defend and Assess for these vulnerabilities.
This represents a significant escalation in instant messaging security threats, particularly affecting the platform’s hundreds of millions of users worldwide. The security community recognizes Haifei Li from EXPMON for discovering and reporting this vulnerability through coordinated disclosure. As of publication, there is no evidence of active exploitation or public disclosure of exploit code. High-risk individuals face a greater likelihood of attacks against their accounts due to a combination of their role and potential access to sensitive information and important people. You might be a high-risk individual if your work or public status means you have access to, or influence over, sensitive information that could be of interest to threat actors. PostMessage-tracker is a Chrome extension specifically designed to monitor and log all postMessage communications.
Duelbits Hot Wallet Hack Drains $7 Million, Forces Platform Offline
ChatGPT might send a few queries or change the wording of the search in an attempt to optimize the results, which are returned as a list of websites and snippets. If possible, it will respond solely based on the information in the result snippets, but if that information is insufficient, it might browse using the open_url command to some of the sites in order to investigate further. It seems that part of the indexing is done by Bing, and part is done by OpenAI using their crawler with OAI-Search as its user agent.
- When enabled, it tracks data flow from sources (including postMessage event handlers) to sinks, such as innerHTML, and alerts you when untrusted data reaches a dangerous location.
- The attack vector is local, meaning an attacker must convince a user to interact with a malicious email to trigger the exploit.
- PostMessage vulnerabilities can represent a significant attack surface in modern web applications, yet they often go undetected due to their client-side nature and the manual analysis required to identify them.
For example, if we want to exfiltrate the word “Hello”, ChatGPT would render the Bing links for H, E, L, L, and O sequentially in its response. If the user asks it to remember something, or if there is some information that the engine deems important even without an explicit request, it can be remembered using memories. As is seen in the System Prompt, the memories are invoked internally using the bio tool and sent as a static context along with it. It is important to note that memories could contain private information about the user. Memories are shared between conversations and considered by the LLM before each response. It is also possible to have a memory about the type of response you want, which will be taken into account whenever ChatGPT responds.
What made these crashes particularly suspicious was their exclusive appearance on devices belonging to individuals likely to be targeted by advanced persistent threat actors. A previously unknown zero-click vulnerability in Apple’s iMessage appears to have been exploited by sophisticated threat actors targeting high-profile individuals across the United States and the European Union. Between 2020 and 2024, messaging apps evolved from casual chat tools into essential communication infrastructure. The COVID-19 pandemic accelerated this shift, with billions depending on these apps for work meetings, virtual classes, and even healthcare consultations.
This approach tricks Gemini’s security mechanisms by presenting a false sense of authorization. Similar to before, this would have allowed us to send malformed data and potentially exploit the DOM-based XSS vulnerability. Misconfigurations that stem from weak regex pattern matching often arise due to a lack of proper testing. The postMessage API is a browser feature that allows secure communication between different window contexts, even when they don’t share the same origin. This browser API was initially introduced to enable controlled cross-origin data exchange, as it provides a way for iframes, pop-ups, and opened windows to send messages to each other without violating the browser’s same-origin policy. Google Project Zero found a vulnerability in top messaging apps that allowed hackers to listen and watch through their victims’ phones without them knowing.
With the change announced here, the NVD will also include any provided “affected” information as represented in the CVE Record Format. Future updates to the website will enable viewing this information on the vulnerability detail page for a particular record. On June 17, 2026, the National Vulnerability Database (NVD) deployed an expansion to its vulnerability assessment metrics and data schema. Furthermore, the NVD will also include „affected” information as defined in the CVE Record Format. Offloading the large and frequently changing “affected” lists to GitHub links significantly reduces bandwidth https://fanfillsreview.com/ and payload sizes in the /cvehistory feed, allowing downstream tools to consume incremental audit updates much more efficiently.