A research team discovered a vulnerability in ChatGPT's share and HTML Preview features that let attackers run malicious JavaScript inside a victim's authenticated chatgpt.com session simply by sending them a link. Once opened, the code could read the victim's private conversations and call ChatGPT's authenticated APIs on their behalf, effectively taking over the account without any further action from the victim. OpenAI fixed the issue on October 26 and classified it as a P1 (critical) vulnerability.
parameter.ai
· 2026-10-31
A new TransUnion report finds that fraudsters increasingly target established customer relationships rather than sign-up processes, using social engineering, deepfakes, text spoofing and stolen credentials to impersonate customers or brands. Account login made up 53% of suspected digital fraud in the first half of 2026, and 58% of organizations said fraud is evolving faster than their ability to detect it.
darkreading.com
· 2026-10-23
A security researcher found that Telegram Desktop's local inter-process communication, used to hand clicked links to an already-running instance, fails to escape its command separator character. This let a maliciously crafted tg:// link be split into multiple injected commands, one of which could trigger an internal scheme that reads a named file and sends it to a chat without asking the user for confirmation. The flaw, tracked as CVE-2026-107181 and rated 8.1/High, was confirmed on Windows up to version 6.9.3 and fixed in Telegram Desktop 7.2.9.
beaksec.github.io
· 2026-10-10
A security researcher discovered a cross-site scripting vulnerability in the ansi2html tool used to render build logs on builds.sr.ht and other Sourcehut instances. The flaw let anyone inject malicious text into a build log, which would then execute in the browser of any user who viewed it, potentially hijacking their account and spreading further through the same mechanism.
blog.arusekk.pl
· 2026-09-24
Prophet Security analyzed every alert across customer environments from May to July 2026, rather than only alerts analysts chose to escalate. Of the incidents fully investigated, 93% were benign and 7% were confirmed malicious, with identity-related attacks accounting for roughly half of that malicious activity. The firm identified session hijacking, token replay, MFA bypass, credential stuffing, and phishing as the dominant attack patterns.
bleepingcomputer.com
· 2026-09-10
Security researchers note that as MFA, conditional access and device trust make direct credential theft harder, attackers are shifting focus to account recovery workflows. Instead of stealing a user's second authentication factor, criminals are tricking service desk staff into resetting or reassigning it on their behalf.
bleepingcomputer.com
· 2026-09-09
GoKawiil