@beaksec

https://xitter.cf/t.co/sBzpMRqEtt

beaksec.github.io/
Joined October 2026
  • Tweets14
  • Following18
  • Followers24
I found a one-click RCE as root in Webmin, CVE-2026-49243. It shipped as 5.1 Medium and was rescored to 9.6 Critical today, so almost nobody has looked at it. An admin clicks a link, commands run as root. Write-up and PoC: beaksec.github.io/posts/webm…

Webmin: one-click RCE via XSS

A reflected XSS in Webmin chains to arbitrary command execution as root on a default install, from a single link. CVE-2026-49243.

beaksec.github.io
1
21
I found a one-click arbitrary file read in Telegram Desktop, CVE-2026-107181. Coverage stops at the account takeover. That is real, but the session files are just one target among everything else you can read. Write-up and PoC: beaksec.github.io/posts/tele…

Telegram Desktop: one-click account takeover via IPC injection

An unescaped separator in Telegram Desktop’s single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.

beaksec.github.io
3
7
11
212
Hey, nobody 👋 Just landed on this platform. Check out my work here: beaksec.github.io/

beaksec

Cybersecurity from a different perspective

beaksec.github.io
2
79
Load more