Telegram addressed a significant security flaw in September 2026 but did not publicly disclose the details. On October 7, 2026, a cybersecurity researcher known as BeakSec released the final version of an attack chain that targeted Telegram Desktop, the desktop application used by the private messaging service. From the user's perspective, the attack was deceptively simple: a victim needed only to be added to a group chat by a stranger and then click on a link shared in the conversation. The vulnerability, labeled CVE-2026-107181, was rated 8.6 out of 10 in severity and affected all versions of Telegram Desktop up to 7.2.8, confirmed to be a problem on Windows systems. The flaw stemmed from a confusion between data and commands within the application. When a "tg:// " link is opened from a web browser, Telegram Desktop sends the link to the already running application through a local communication channel between processes. This link is converted into a text string in the format "OPEN:<url>;"—where "OPEN:" signals Telegram to open the following address, and the semicolon marks the end of the command. The vulnerability arose because Telegram did not properly protect semicolons that might appear in the URL itself. This allowed an attacker to include semicolons in the link. The sending process treated them as regular characters, but the receiving application interpreted them as the end of one command and the start of another. As a result, a single clicked link could trigger multiple commands. One of these commands activated an internal tool within Telegram Desktop, originally intended to publish application updates. This tool followed a list of instructions to send a file to a conversation. The attacker needed only to place this list of instructions in a group chat where the victim was a member, allowing Telegram Desktop to automatically save the file on the victim's computer. When the victim clicked the link, the application sent the files to the attacker, enabling them to maintain a connection. If the victim had not set a password on their Telegram account, the attacker could then access the account from another computer and take control of it. The vulnerability was reported to Telegram on June 25, 2026, and was fixed on September 16, with version 7.2.9 released the following day. However, BeakSec noted that the update note mentioned only a display issue and that the critical fix was described with an innocuous title about removing an old utility. No formal security advisory accompanied the update. The fix removed the faulty function and now prevents semicolons within a link from being interpreted as command separators.