30024
This is the English mirror of @tginfo. Ask Questions & Discuss: @tginfochaten Beta Channel: @betainfoen TON: @infotonen Other Languages: @tginfoall Feedback & Commercial: @infowritebot CC-BY 4.0
Researcher Bypassed Telegram’s Server-Side Sticker Verification for a Zero-Click iOS Hack — Meanwhile, the Messenger Replaced the Vulnerable Library
UPD 22:00 UTC. The researcher confirmed that Telegram has patched the flaw when migrated its clients to the tlottie library. Official clients users with latest updates installed are safe.
Cybersecurity specialist Saifeldeen Aziz announced a talk at the OffensiveCon conference — the researcher spent a year studying the security of Telegram stickers. Telegram very recently overhauled its sticker library, so without further details, it remains unclear whether the updates have fixed the announced vulnerabilities.
There is likely no direct threat to Telegram users on the latest versions of the official apps right now.
What exactly did the researchers find?
• Using AI-driven fuzzing, the cybersecurity team found several vulnerabilities in the rlottie library, which is responsible for rendering animated stickers. In Telegram for iOS, this makes it possible to execute code on the victim’s device.
• Telegram relies on server-side verification to filter out malicious files.
• The researcher discovered logic flaws in how stickers are delivered and verified, using them to bypass the security mechanisms.
• According to the author, even after receiving the reports, Telegram continues to rely on server-side checks, while the vulnerable rendering code remains in the official clients.
Telegram replaced its sticker library
While the research was underway, Telegram changed its approach. The messenger published tlottie — a new sticker rendering library vibe-ported to Rust. It is already used in Telegram Desktop, Telegram for macOS, and Telegram for Android; since September, it has also been used in Telegram for iOS.
The tlottie library eliminates an entire class of memory bugs that have been used for sticker-based attacks for years. In the view of @tginfo editors, by updating the library in client apps, the messenger’s team demonstrates that it does not rely solely on server-side checks in matters of security.
Are these findings still relevant?
• The presentation materials have not yet been published online. Which versions the exploit chain was tested on and the exact nature of the vulnerabilities will become known later.
• The research took a year, and the announcement specifically focuses on rlottie. Therefore, there is reason to doubt that the issue persists in the latest versions, although this still cannot be ruled out. Furthermore, logic flaws in sticker delivery and verification do not depend on the rendering library.
• Rust is no guarantee. There have been no independent audits or public analyses of tlottie yet, so the library will only be able to prove its quality over time.
A systemic problem
The history of sticker vulnerabilities goes back many years. Back in 2020, Shielder researchers discovered 13 bugs in rlottie that allowed for remote memory corruption on a device. At the time, Telegram only patched those specific errors.
Meanwhile, the company publicly denied the risks. In 2025, the exploit broker Operation Zero offered up to $4 million for zero-click exploits targeting the messenger, while a Telegram representative told Forbes that the messenger had “never been vulnerable to zero-click exploits”.
In March 2026, an entry regarding a vulnerability in Telegram stickers appeared in the Zero Day Initiative database. The messenger’s press service stated to Durov’s Code that “the existence of such an exploit is impossible” because all stickers are checked by servers. At the time, @tginfo editors pointed out that server-side validation is merely one layer of protection that can itself contain errors — a conclusion supported by the findings of the new research. In October, ZDI published the full details of the vulnerability, marking it as unpatched.
In their announcement, Saifeldeen Aziz questions Telegram’s approach to security and speculates that such vulnerabilities could be used to create backdoors.
In the view of @tginfo editors, the transition to tlottie is the first step in many years toward solving the underlying problem rather than applying another patch. Telegram often aggressively denies the possibility of any vulnerabilities or silences issues. @tginfo editors note that trust is built not by such declarations, but by openly acknowledging problems and allowing independent code verification.
#vulnerabilities
Telegram for Android, iOS, and macOS Have Been Updated to 13.1, and Telegram Desktop to 7.3.2
The October Telegram update brings new features related to customizing the Gram Wallet, personalizing your profile, and managing gifts.
• Customizing the Gram Wallet card: Users can now decorate their crypto wallet card with collectible gifts. These can be placed as stickers, and also used to customize the background.
Currently, only gifts from the Plush Pepe and Resistance Dog collections are available for the background.
• Gram Wallet balance in profile: User profiles now feature a crypto wallet card displaying the balance. Other users can tap on it to see the chosen customization.
The balance is only displayed if there are at least 0.01 Gram in the wallet. If there are fewer funds, it will be hidden from the profile.
• Personalizing QR codes: Telegram has updated the profile QR code editor, adding the ability to change the background, decorate it with emojis, and apply customizations using collectible gifts.
The chosen design will be visible to other users. Most of the new settings are only available to Telegram Premium subscribers, while changing the color remains free.
• Links for free messages: Users who have enabled payment for incoming messages can now create special links that allow other people to message them for free.
Whenever necessary, the right to sending free messages can be revoked from a specific user.
• Simplified transfer of NFT gifts: When sending a gift, there is now an option to transfer it to your own wallet on the TON blockchain without the need to use Fragment.
• Deleting non-unique gifts: It is now possible to delete non-unique gifts.
Other new features
• Added support for quoting rich messages. Previously, only regular messages could be quoted.
• Telegram Desktop for Windows has been updated to Qt 6, the new major version of the cross-platform framework on which the application's interface is built.
Download the update
• Android: Google Play, APK from the official website or the verified channel.
• iOS: App Store.
• Windows / macOS / Linux: official website or GitHub.
• Windows: Microsoft Store.
• Linux: Flathub, Snapcraft.
• macOS: App Store or from the verified channel.
#update #Android #iOS #Desktop #macOS
Telegram Introduces Free Message Links and an Updated QR Code Editor
The personal profile QR code screen has been updated in the Beta versions of Telegram for iOS 13.0.1, Telegram for macOS 13.0, and Telegram for Android 13.1. Alongside new appearance settings, the messenger now allows users to generate special links and QR codes that let others message them for free even when paid messages are enabled.
How it works
If you have set a fee in Stars for incoming messages, a “Remove message fee” button now appears below your profile QR code.
When activated, it appends a randomly generated access token to your profile link. Your regular profile link will still require payment, while sending messages for free will only be available to those who follow the link or scan the QR code containing a valid token.
By default, the generated QR code is temporary and remains valid for 1 minute — this is handy when you want to show it to someone on your phone screen in person.
In the code management menu, you can adjust these settings: make the link permanent (Disable timer), limit its validity to one minute again (Expire after 1 minute), reset the token to invalidate the old link (Reset Code), or re-enable paid messages altogether (Restore message fee).
This feature is useful if you want to protect yourself from spam and unsolicited direct messages while still providing a “free” entry point on your website, on a business card, or in a private community where friends or potential clients might look for you, or if you want to automate link distribution via a bot.
New QR code design
Customizing the QR code’s appearance is no longer limited to preset themes: users can now pick colors from a wide palette, use any emoji as a background pattern, or select unique collectible gifts from their profile (the latter requires a Telegram Premium subscription).
Because of this, only the account owner can now manage the appearance of their QR code screen. Any decorations applied to the link’s design are visible to other users.
#iOS #macOS #Android
Telegram updated to version 13.0: native wallet and instant Gram transfers
Telegram has begun rolling out its own non-custodial wallet, Gram Wallet, in stages. For now, the service supports only Gram cryptocurrency and NFTs associated with the messaging app: collectible gifts and usernames, and anonymous numbers.
Gram Wallet is currently available to a limited number of users. To unlock access to the wallet before it rolls out to all Telegram users, you’ll need to update the app to the latest version and receive a transfer of at least 0.1 Gram from another user.
Once the wallet is activated, its balance will appear in the “Money” section of Settings, in place of the Wallet bot, which was renamed Walt and hidden from the main menu shortly before the native wallet launched. You’ll also be able to instantly send Gram to people you’re chatting with through the Gram tab in the attachment menu of a one-on-one chat.
One feature of the integrated wallet is the ability to make up to five Gram transfers a day to other Telegram users or wallet addresses without paying TON blockchain fees. The first transaction, however, is subject to a smart contract initialization fee.
Subscribe to our channel @infoton to stay up to date on developments involving the TON blockchain and Gram cryptocurrency.
Interactive web messages right in the chat
The TBetaLeak channel discovered a large experimental subsystem called HTMLBubbles in version 12.10.283300 of Telegram for macOS.
According to the description, the messaging app is testing interactive messages built with HTML, CSS, and JavaScript right in the chat, without the need to launch a separate Web Mini App window.
@tginfo editors have confirmed the module’s presence in the code of that version based on a preliminary review, but the described behavior and how it works have not yet been independently verified.
The idea is to turn ordinary messages into widgets: product cards with selectable options, interactive boarding passes, or live charts.
According to the source, rendering is handled by the compact litehtml engine, while scripts run in a heavily restricted sandbox with CPU limits, network requests blocked, and external media prohibited. You can read all the technical details about these restrictions in the source post.
Editors’ concerns
Despite the extensive list of restrictions, @tginfo editors have serious security concerns about this kind of feature. Integrating web engines that support JavaScript execution — even in a heavily restricted form — directly into the chat interface poses a huge risk.
Experience shows that no matter how thoroughly developers isolate an environment, vulnerabilities are regularly found in rendering systems. The risk of malicious code running simply by viewing a chat raises serious questions about whether these widgets are worth it.
For now, HTMLBubbles is an early experimental concept being tested within the Telegram team. The feature could change substantially during development or be canceled entirely.
#macOS #beta
Improvements to Video Messaging on Android
In the beta version of Telegram for Android for the upcoming 12.10.4 update, a new section called "Round Video (Experimental)" has been added to the settings.
That page includes several experimental features that allow you to set the focus and smoothness of video messages recorded using the modern Camera2 API:
• Output resolution: 360p / 480p.
• Camera resolution: Low / Medium / High.
• Frame rate: 30 FPS / 60 FPS.
• Video bitrate: 750 kbps / 1 Mbps / 1.5 Mbps / 2 Mbps.
⚠️ Please note: Telegram notes that 60 FPS is used only if both the front and back cameras on the device support this frame rate. Otherwise, recording automatically switches to 30 frames per second.
⚠️ Please note: This option does not alter the appearance of video messages that are sent to chats; the "circles" within the messenger remain circular regardless of whether you have disabled their stylization during the download process.
Subscribe to our second channel @BetaInfo to be the first to know about upcoming Telegram updates.
Telegram Desktop updated to version 7.1.1
What's new:
• Added welcome messages for groups and channels.
• Added buttons and files in articles.
• Improved lists, tables, and Markdown text pasting in the article editor.
• Added self-destruct timers and view-once feature for photos and videos.
• Added video profile picture upload for users, chats, and channels.
• Added a video editor with the ability to trim and crop the clip, change its quality, and set a cover.
• Added the ability to restore open windows and chats upon restart.
• Added new keyboard shortcuts to restore closed windows (Ctrl + Shift + T), as well as to open the article editor (can be assigned in Settings › Chat Settings › Keyboard shortcuts).
• Added the ability to send music files via the attachment menu.
• Added a new proxy type called WEB in the Connection settings.
• Fixed bugs that caused crashes.
Download:
• Windows/macOS/Linux: official website or GitHub
• Windows: Microsoft Store
• macOS: App Store
• Linux: Flathub, Snapcraft
#update #Desktop
The Australian Internet Safety Regulator Sues Telegram
The regulator claims the service is ignoring the country's laws, citing the messenger's lack of action in deleting terrorist propaganda materials. The government doesn't intend to ban Telegram yet, although it has the power to do so.
The Australian government's demands stem from user reports claiming that videos are being spread on Telegram featuring the Christchurch mosque shootings in New Zealand in 2019 and shootings in a US supermarket in 2022.
"We have alleged that Telegram has failed to detect, deter and disrupt pro-terror material", eSafety commissioner Julie Inman Grant said.
"We've never used those powers, and we'll see how this all plays out and whether that kind of action is warranted", Ms Inman Grant said.
Fullscreen Rich Text Editor, Communities, New GIF Search, and Ephemeral Messages
Telegram for Android and iOS updated to version 12.9, while Telegram Desktop updated to version 7.0. In its July update, Telegram brings a much more extensive variety of text formatting options, communities, and much more:
• Advanced Text Editor: Users can now send Rich Formatting messages from the new full-screen text editor. It includes many styling options: headings, tables, lists, quotes, LaTeX math formulas, code blocks, and expandable spoilers. It also allows users to mix photos and videos right in the middle of messages by creating collages or carousel slideshows.
The editor is available under 📎 Attach › Article. Alternatively, in mobile apps you can tap the ↖ icon above the “Send” button. The full-screen editor allows users to send messages that are up to 32,768 characters long.
Most of the key features of the full-screen editor are only available to Premium users, although the full-screen UI itself can be used for free.
• Communities: Organize communities that bring theme-related chats, channels, or even bots closer together. You can't add big entities, though: Telegram limits chats and channels by their member count. The @tginfo editors are still researching the limitations of this feature.
Make sure not to confuse communities with forums: each chat and channel remains independent, while users can view the list and join each separately.
Community chats can be visible to all members or be hidden, in which case only community admins and the members of the hidden chat can see it. Community chats and channels can merge into a single item in the chat list — this is controlled by each community member for themselves.
• Ephemeral messages for bots: Bots and users can now message and reply to each other privately even in the middle of a group chat — such messages are visible only to the specific recipient and the bot that sent them. Ephemeral commands and replies to them are marked with a special 👁 crossed-out eye icon.
When a command is ephemeral, the user's initial message remains fully invisible to all members and bots, which allows confidential interactions to take place even in public spaces. Besides, such messages will be invisible if you log into your account from a new device.
• Updated GIF Search: The GIF panel now searches across 350 million GIF animations in 36 languages. The search engine works thanks to Telegram's indexing of widely shared, publicly available GIFs using the in-house Cocoon AI project. Alas, Telegram doesn't clarify what “publicly available” entails.
The change was caused by Google shutting down access to its Tenor GIF library. Telegram claims the new GIF search is private and doesn't depend on third-party services, and adds that it works much faster than before.
Article: telegram.org/blog/communities-editor-invisible-messages/
Download the update
• Android: Google Play, APK from the official website or verified channel.
• iOS: App Store.
• Windows/macOS/Linux: official website or GitHub.
• Windows: Microsoft Store.
• Linux: Flathub or Snapcraft.
#update #Android #iOS #Desktop
The t.me Domain Has Been Restored by the .me Registry
Checks by the @tginfo editors show that the .me zone's main server has returned the DNS records for the t.me domain.
Since DNS records are cached at the level of various DNS services and providers, it may take up to 24 hours for service to be restored on users' devices.
#outages #bans
The .me registry has blocked the t.me domain
UPD July 14, 13:00 UTC: The domain was restored.
Telegram users worldwide have encountered an outage: short t.me links have stopped opening in regular browsers. The problem affects users in the entire world.
At the same time, within the mobile and desktop Telegram clients themselves, clicks on links are processed correctly, and redirects work without any problems. As a temporary alternative for posting on external resources, you can use telegram.me links.
Technical details
At the moment, the exact causes of the incident remain unknown.
According to WHOIS data, the t.me domain has been completely removed from the DNS zone by the administration of the .me domain registry.
This status is set not by the registrar (GoDaddy), but directly by the main operator of the domain zone — the Montenegrin company doMEn d.o.o., which manages the entire .me zone. This organization is a joint venture of Identity Digital, GoDaddy, and ME-net.
#outages #bans
Communities Are Now Being Tested in Telegram
In Telegram beta for Android, version 12.9, users can now organize communities that bring theme-related chats closer together.
The details:
• Chats Only: At the moment, only chats can be added to communities.
• How to Join: Telegram treats you as a member of a community if you join any chat linked to that community.
• What This Offers: If a chat is linked to a community, this is highlighted on the chat's profile page. From there, members can navigate to other chats in the community. Members can view the list of all “visible” chats in the community and join them.
• Chats Stay Independent: Telegram won’t add you to other chats in the community automatically. Different owners can offer to add their chats to a community.
• Can Merge Visually: Community chats can display separately or merge into a single item. This behavior is controlled by community admins using the “Show as One Chat” toggle. When it’s active, the community looks similar to forums, but each topic is instead an independent chat you can join.
• Hidden Chats: A chat can be added to a community with “hidden” visibility. A hidden chat can be seen only by those invited to it separately. This is similar to general and hidden channels in Discord servers. Members of the hidden chat can navigate into the community, while other community members can’t see the hidden chat.
• If We Should Expect Channels: The app code mentions adding channels, but the feature is unavailable, so it’s not clear whether it will be added in the future.
Creating communities is available only on the test server at the moment. You can add your group chat to a community in chat settings—just tap the “Add Group to a Community” option.
Subscribe to @betainfo — our second channel. There, our team shares all the new features discovered in the Telegram beta versions.
Telegram Is Banned in India, Deleted from App Stores, Suffered a Global Outage
The Indian government ordered a temporary ban on Telegram due to mass leaks of NEET-UG exam questions. However, a local telecom‘s attempt to restrict access led to interceptions far beyond the country. Editors at @tginfo explain how local censorship turned into a global outage.
What Happened in India
The formal reason for the ban was leaked questions for the national medical exam in Telegram channels. Currently, the official Telegram client has been removed from the Indian App Store and Google Play storefronts.
Pavel Durov points out that this move punishes 150 million users in India, while the leaks simply migrated to a different app, and that Telegram cooperated with regulators by deleting “hundreds of channels sharing leaked exam materials and related scams in India”. The CEO also adds that the messenger team has “been making the ‘edited’ label more visible to prevent backdating scams”, although it is not clear whether this change hasn't shipped yet or is some local change that our editors couldn‘t confirm independently. The “edited” indicator changes are said to be done to fight backdating scams.
For context, India is one of the biggest Telegram markets. The Indian government tried to pressure Telegram before: in 2022, a court demanded the disclosure of pirate channel owners‘ personal data. At that time, Telegram only complied on paper, stating that it didn‘t store the requested data on its servers. It is clear that this time the government is trying to act with more force.
From a Local Ban to a Global Outage
Trying to restrict Telegram inside the country, an Indian telecom company used a BGP routing hijacking trick.
• The Internet is made up of many interconnected networks that tell each other the data paths using the BGP protocol.
• An Indian telecom company announced to the whole world that it owns Telegram's IP addresses, forcing part of the global traffic to be sent through the false route, which blocks access to the messenger.
• Since many service providers around the world still don‘t verify the authenticity of the routes they receive, the false routes spread around the globe.
As a result, connectivity issues could be observed even outside India, including regions like the UAE. Similar incidents happened before: for example, in 2023, the Iraqi government used a similar trick to ban Telegram.
Industry experts point out that the Indian telecom even got into a brief network war with Telegram, in which one company tried to overwrite the opponent‘s routing directions. Pavel Durov announced that Reliance stopped malicious routing four hours after his post.
Erroneous Accusations Against Meta Trying to Blame for All Their Problems
Pavel Durov called the service provider‘s actions intentional sabotage and assumed that it might be part of the competitive war that WhatsApp is leading against Telegram, based on a claim that Reliance is partially owned by Meta (parent company of WhatsApp and Facebook).
Despite this, community and media research shows that Pavel Durov confused two companies. The network system that was hijacking the traffic is owned by Reliance Communications, an old telecom asset midway through bankruptcy, while Meta invested in a completely unrelated company — Jio Platforms (which also owns Reliance Jio, a large Indian service provider).
The theory about WhatsApp‘s corporate conspiracy couldn‘t be backed by any technical data. It is likely that the global traffic hijacking was caused by incompetence among the engineers at the Indian company responsible for configuring the hardware to block Telegram. It is not the first time that Pavel Durov has publicly accused WhatsApp of attacking Telegram, explaining unfavorable events with conspiracy theories.
#India #censorship #outages
Telegram for Android and iOS Got a 12.8 Feature Upgrade
The June update resurrected the smartwatch apps and added even richer text formatting for bots.
• Telegram for Smartwatches: After many years, the messenger brought its smartwatch apps back for both Apple Watch and Android Wear OS (we fellow Pebble users sob in the corner).
The watch apps support basic features like sending text and voice messages, and viewing media attachments and video messages.
• Dozens of New Rich Text Options: This update allows Telegram bots to send more structured Markdown messages. The supported formats include all sorts of heading options, tables, blocks and spoilers, LaTeX math formulas, to-do checkbox lists, and any attachments in the middle of message text, including collages and carousel slideshows.
You can explore the new formatting in the interactive demo available at @RichTextDemoBot.
According to Pavel Durov's post on Twitter, rich formatting for regular users is planned for later this month, as the team needs to "test everything on bots first".
Passkeys in Third-Party Telegram Clients
Instructions describing how Passkey authorization works for third-party clients have appeared in the Telegram API documentation.
The main caveat of this new feature is that Passkeys will not be universal. You will not be able to log into the official Telegram app using a passkey created in a third-party client (and vice versa).
As a reminder, late last year Telegram added support for Passkeys — a convenient and secure way to log into your account using biometrics or a PIN code without needing SMS. In our FAQ at the time, we clarified that this option was only available in official Telegram clients.
💬 You can only use Passkeys to log into an existing account. Creating a new account still requires receiving an SMS code.
Passkeys only work in the app where they were created. A Passkey from the official Telegram app will not work for a third-party client, and a key from a third-party app cannot be used in either the official Telegram app or any other unofficial builds.
Interactive HTML Messages Are Now Working in the Android App
A working prototype of the experimental HTMLBubbles technology is confirmed in the Beta version of Telegram for Android 13.2.
It makes it possible to create interactive messages built with HTML, CSS, and JavaScript that are displayed right in the chat without opening a separate Mini App. To test the feature, @tginfo editors created their own HTML widget. Using it, they confirmed the execution of JavaScript and basic functions of regular websites.
Similar components were also found in the Beta version of Telegram for iOS 13.2, which now includes built-in tools for testing widgets as well.
Security concerns
So far, no dedicated toggle to disable HTMLBubbles has been found in the settings of the tested Beta versions.
Previously, @tginfo editors expressed concerns about executing JavaScript right in the chat.
As a reminder, a vulnerability (CVE-2026-107181) was recently discovered in Telegram Desktop that allowed files to be stolen through specially crafted links.
Although that flaw is unrelated to HTMLBubbles, introducing a new mechanism for executing code inside messages could lead to much more severe vulnerabilities that require no user interaction to trigger (zero-click).
When will the feature be available to everyone?
For now, HTMLBubbles remains an experimental technology. The ability to send such messages is restricted, and a public API for developers has not yet been introduced.
#Android #iOS #beta
Gift Sale Scam
In recent days, there has been a rise in scams targeting users who own collectible gifts.
How the scam works
A user receives a message in a private chat that looks like an official gift purchase offer. In this message, the scammer prompts the victim to tap a button to transfer the gift to the buyer, promising that the victim will immediately receive a reward in Stars. In reality, however, the button contains a link that simply transfers the gift to another user for free.
How to verify a purchase offer?
Here is how you can tell a genuine gift purchase offer from a fraudulent one:
• A genuine offer is displayed in the center of the screen, whereas a fraudulent one is aligned to the left (just like regular messages from your chat partner).
• A genuine offer contains a small image of the gift the buyer wants to purchase, the text “The user offered you xxx ⭐️ for your gift <gift_name_with_number>”, the offer’s expiration time, and the “Decline” and “Accept” buttons. The content of a fraudulent message may differ.
• If you change the app’s interface language to English, the text of a genuine offer will also be displayed in English. The language of a fraudulent message will not change.
• If you press and hold the “Accept” button in a genuine message, nothing will happen. If you do the same on the button in a fraudulent message, the Telegram app will reveal the link hidden behind that button — typically, this link starts with tg://send_gift.
Please be on alert when receiving gift purchase offers: check them carefully to avoid losing your gifts.
How to protect yourself from risk?
If a gift is hidden on your profile, no one will be able to send you an official offer to buy it. To hide a gift from your profile, open your list of gifts, tap on the desired gift, and then tap the “Hide” button.
What to do if you have already transferred the gift?
1. It is impossible to get the gift back. You will not be able to prove to Telegram Support that you were deceived. Providing them with screenshots is pointless: they can be forged, and Telegram moderators do not have access to private chats.
2. You can report scammers to Telegram: see section 1.2 (“Report Violation”) of our article “How to contact Telegram?”. Unfortunately, a single report is usually not enough for Telegram moderators to ban a scammer’s account. Moreover, scammers typically have many backup accounts.
#security #gifts #scam
Telegram Is Testing a News Feed and Personalized Recommendations Again
A separate “News” tab for viewing channel posts in a unified feed has appeared in Telegram for macOS Beta 13.0 (283318). The @telelakel channel reported the discovery.
How the news feed works
The current implementation of the post feed has several key features:
• Two sections: The “News” tab is divided into two sections — “Added” and “For You”.
• Custom feed: In the “Added” section, users can manually curate their feed by adding and removing selected channels through dedicated interface actions.
• Personalized recommendations: The “For You” section curates posts based on the user’s interests. Categories of interest (each with its own name and emoji) can be selected manually and changed over time. However, it remains unknown what algorithm powers this feed and whether it will include posts from channels the user isn’t subscribed to.
• Navigation and speed: The feed interface includes a search bar, pull-to-refresh, a new posts indicator, and a button to mark posts as read. Directly from the feed, users can open individual posts and channels, jump to chats, and copy links. For faster browsing, media files, profile pictures, and stories are preloaded in the background.
Background and context
The messenger’s team has been approaching the creation of a unified feed for eight years:
• The ability to combine channels into a unified news feed first appeared in the Beta version of Telegram for macOS back in January 2018, but was soon disabled on the server side.
• In April 2022, a commit confirming the development of a news feed was spotted in the official Telegram for iOS repository, though the feature never made it to release.
• Meanwhile, between 2019 and 2021, Telegram held a series of large-scale contests focused on news ranking and data clustering, as well as identifying channel languages and topics.
• Until now, the primary way to read subscriptions sequentially in the messenger has been the gesture for jumping to the next unread channel, while algorithmic recommendations have been limited to the “Similar Channels” list and the “Channels” tab in global search.
@tginfo editors note that introducing an algorithmic feed in the spirit of X (formerly Twitter) could significantly reshape how content is consumed in the messenger. For creators, it is a potential source of free organic traffic without buying ads, and for Telegram itself — a way to boost audience engagement and increase impressions for official ads.
Currently, the news feed is disabled on the server side and remains in development — its mechanics and appearance may change by the time of release.
We share more news about features from test builds in our Beta Info channel.
Dangerous vulnerability in Telegram Desktop: any file can be stolen with one click
What you MUST NOT do and how to protect yourself:
• Do not keep using versions earlier than 7.2.9 — update the client immediately. If you use an unofficial client, temporarily switch to the official one until an update is released.
Download:
• Windows / macOS / Linux: official website or GitHub.
• Windows: Microsoft Store.
• macOS: App Store.
• Linux: Flathub, Snapcraft.
Advice for users of older clients:
• Links can be dangerous: whenever you click a link, read the pop-up window carefully — if Telegram shows an unusual structure in the link (for example, one starting with tg://), do not open it.
• Do not use the client without a local passcode: enabling one encrypts the session files in the tdata directory, preventing immediate account hijacking even if those files are leaked.
What is the issue?
A vulnerability has been discovered in Telegram Desktop clients earlier than version 7.2.9 (CVE-2026-107181). Because the ; delimiter was not escaped, parameters in tg:// links were interpreted as separate IPC commands. Using the interpret: handler, an attacker could cause files from the system to be sent covertly to their channel, without the user’s confirmation, when the user clicked a specially crafted link.
The main risk
The danger is not limited to stealing tdata session files and hijacking accounts. Exploiting the vulnerability makes it possible to covertly steal absolutely any files on the computer that the user can access: documents, saved browser sessions, SSH keys, system configurations, or cryptocurrency wallets.
#security #desktop #vulnerabilities
Wallet bot renamed as Walt — and disappears from the app menu as Telegram prepares its own replacement
On September 28, 2026, users noticed that Telegram had stopped promoting Wallet. The bot itself had been renamed Walt and given a new logo that no longer made it look like an official Telegram service.
In 2023, Telegram and the TON Foundation publicly announced a partnership, and the Wallet bot was closely integrated into the messaging app. In particular, Telegram began displaying the wallet in the app’s menu, promoting it to all its users.
The Wallet bot was launched in 2022 by a company associated with the TON Foundation. At the time, the @tginfo editors expressed the view that Wallet was being developed in close cooperation with Telegram. Today, the company that owns the Wallet bot is known as TOP (The Open Platform).
The @tginfo editors link these changes to the Telegram team’s preparations to launch its own Gram Wallet, which will become the primary wallet for Telegram users.
The history of Telegram Open Network (TON) and Gram
In the view of the @tginfo editors, the TON Foundation and the Wallet bot, now known as Walt, are the result of a hybrid strategy Telegram pursued because of the SEC’s 2020 ban on developing TON.
Telegram is now replacing the bot with the fully integrated Gram wallet, in line with the original 2019 vision. Telegram may have decided to take back direct control of the blockchain thanks to the significant deregulation of cryptocurrencies in the US in recent years.
Preparations for launch and investment
The first rumors about the Telegram Open Network (TON) blockchain and its cryptocurrency, Gram, both developed by the Telegram team, surfaced in 2017.
In 2018, Telegram held a private ICO and raised about $2 billion. At the time, some believed that Telegram was developing TON in part to hold an ICO and raise funds to keep the company going, while avoiding the obligations associated with issuing securities and the need to introduce advertising and paid subscriptions in the app.
By early 2019, it had become clear that the cryptocurrency was being prepared for launch and integration with Telegram in the coming months, in line with previously leaked plans. That same year, an experimental built-in Gram wallet appeared in the app.
The SEC lawsuit and the freeze
In October 2019, the US Securities and Exchange Commission (SEC) sued Telegram, alleging that Telegram was selling securities, not virtual currency, through its ICO. In 2020, Telegram signed a settlement that forced it to refund investors and officially discontinue work on TON. Telegram froze development and removed most mentions of TON and Gram from the app.
After losing the investments raised through the ICO, Telegram began financing itself through Eurobonds and other types of bonds. Telegram did not repay its first debt tranche, issued in 2021, until 2026.
After Durov’s team left, the developer community split into two parallel branches:
• Free TON: An independent group led by TON Labs, a validator, launched a separate network with the TON Crystal token.
• NewTON (TON Community): Another group of independent developers continued supporting the original testnet2 network created by Durov’s team and focused on preserving TON’s original architecture and concept.
The birth of the TON Foundation and the hybrid era
In August 2021, Telegram officially chose the NewTON team, handing over the official ton.org domain and the project’s GitHub repository to it. The NewTON team then renamed itself The Open Network (TON Foundation), and the native token was named Toncoin.
Although Telegram and the TON Foundation were independent, the @tginfo team believes there was an informal connection between them that allowed Telegram to continue working on TON. By maintaining formal independence, Telegram may have been trying to avoid scrutiny from the SEC and other regulators.
In 2022, former VKontakte executive Andrey Rogozov, who had worked with Durov for a long time, and other developers joined the TON Foundation. In 2023, Rogozov also became head of The Open Platform (TOP). A press release states that TOP was formed by merging First Stage Labs with the Wallet team inside Telegram.
Before 2024, the makeup of the TON Foundation team changed quietly, and it appears that at some point Rogozov stopped actively participating in the foundation and focused on The Open Platform. Meanwhile, Telegram maintained closer ties with TOP than with the TON Foundation.
Telegram began a cautious integration: it launched TON-based auctions on the Fragment platform, introduced payouts in TON, enabled gifts to be registered as NFTs, added support for TON Sites to the app, and required Mini Apps to use TON.
It was in this context that Wallet appeared. In the view of the @tginfo editors, it may have been one of the main drivers behind the emergence of the Web Bots / Mini Apps platform in 2022. In 2023, it began appearing for all Telegram users as the default wallet app. Legally, however, it was operated not by Telegram but by the TON Foundation and, later, Rogozov’s TOP.
MTONGA
In spring 2026, Pavel Durov announced the launch of the Make TON Great Again (MTONGA) initiative — a sweeping seven-step program intended to bring TON back to Telegram, transforming it once again from a standalone cryptocurrency project into Telegram’s native blockchain.
Telegram regained control of the blockchain and its status as lead validator, upgraded the blockchain, restored the cryptocurrency’s original name, Gram, and announced plans to integrate a native wallet into Telegram apps. However, it appears that Rogozov’s team’s Walt wallet is not part of the MTONGA plans.
TOP and its Walt wallet will continue to operate independently. In early 2026, TOP planned to buy the popular non-custodial wallet Tonkeeper from its founders. The full acquisition of its shares did not go through, but in August 2026 TOP took over Tonkeeper’s operations. Tonkeeper also owns the Tonviewer blockchain explorer, which was used in official Telegram apps to inspect blockchain transactions.
In 2026, this blockchain explorer, which was under the control of Rogozov’s company, began displaying casino ads, so Telegram replaced it with Tonscan. Telegram chose not to return to Tonviewer even after it removed the ads.
It’s worth noting that Telegram’s new wallet is not being built from scratch: Gram Wallet is being developed in collaboration with the My Wallet team (formerly MyTonWallet). The project includes native integration directly into Telegram apps, as well as a standalone iOS/Android app and a web version. Telegram’s wallet is fully non-custodial.
Welcome Messages, Article Buttons, New Table Options
The August Telegram update coincides with the messenger's 13th birthday: the mobile apps have updated to version 12.10, while Telegram Desktop has received a version 7.1 update. This update introduces the following features:
• Welcome Messages: Admins can set and edit up to 3 welcome messages in their groups and channels. The message appears for the user when they join the chat or channel, but it is ephemeral and invisible to other members.
To set a welcome message, open group or channel Settings > Welcome Message. Only the owner and admins with “Manage Welcome Messages” permission can change this setting. Even if you are an admin who had full permissions in a chat or channel, this permission is not granted by default.
• Buttons in Articles: Users can now turn part of the text in paragraphs into buttons that are styled to look like links. The feature is available in the built-in full-screen article editor on Android and Desktop, but not iOS.
The buttons can currently perform three types of actions: Link, Copy, or User Profile. The created button can be configured — for example, the style of the button can be set to dangerous (red), success (green), or primary (theme accent color). On Android you can set the style by tapping the link-button a few times, until you get the needed color.
Keep in mind: Together with inline buttons, Telegram introduced full-sized buttons in articles. There are differences in how they are created across platforms:
• Android: Type the / symbol and select “Button” in the dropdown menu.
• iOS: Tap “+” and select “Button Row”.
• Desktop: Tap 🔗 and choose “Button”.
Telegram Is Working on Experimental WEB-Proxy
A new experimental proxy type titled “WEB” was found in Telegram Desktop's code. The discovery was publicized by teleLakel.
The server code for the WEB-proxy is still under development, and Telegram hasn't endorsed any implementations yet, so there is no good way to try the technology at the moment.
Why is this necessary, and why not just use MTProxy?
The already existing MTProxy can also mask to appear as HTTPS traffic using the FakeTLS extension. However, modern Deep Packet Inspection systems (DPI) can already tell such connections apart, since FakeTLS still has some differences from real HTTPS traffic that can be seen from the outside.
The new WEB transport makes detection much harder: to talk to the server, the messenger uses the built-in browser (WebView). It establishes a real TLS/HTTPS connection using standard browser cryptography, which makes Telegram traffic less different from regular web surfing.
How does it work
• The messenger opens a special page on the proxy server domain using a hidden browser
• This domain can also continue to work as a regular website. The hidden Telegram channel only activates if the request contains the correct secret key.
• Inside the unitary web channel, the encrypted MTProxy traffic is enveloped into WEB-proxy frames and sent to the proxy server. Currently, this is done using WebSocket.
• HTTP/WebSocket traffic is repackaged and relayed to the MTProxy server without being decrypted.
Currently, the feature is under active development, so by the time it gets released, the protocol may change.
The .me registry commented on the suspension of the t.me domain
A representative of the .me domain zone administration commented on Twitter about the situation regarding the ban of the t.me domain, which belongs to Telegram:
The .ME Registry works closely with law enforcement to monitor and mitigate issues across the .ME domain in accordance with applicable laws, including sanctions requirements.
On 13 July, First VPN Service (1VPNS) was included as a sanctioned entity by the U.S. Department of the Treasury. A Telegram channel using the t.me domain was among 1VPNS identified infrastructure. Accordingly, the t.me domain was suspended.
On 14 July, Telegram provided confirmation that it had removed its links and affiliations with 1VPNS. Once the confirmation was reviewed and verified, the suspension was removed from the t.me domain.
We appreciate Telegram’s prompt cooperation in resolving this matter.
Exclusive Access to New Bot API Hosting
Using the official @ContestBot, the messenger team is sending service notifications to some winners of past Telegram contests.
People who distinguished themselves in the contests are invited to join a private test of a new Bot API paradigm — Telegram Serverless. It will allow developers to launch and maintain Telegram bots and Mini Apps on Telegram servers, without deploying their own infrastructure.
“As a winner of a previous Telegram competition, you are invited to exclusively test Telegram's new Bot API. It allows you to run your bots — including their code and databases — directly on Telegram's infrastructure, without using your own servers”, says the service message.
Telegram Is Still Working on Restoring the t.me Domain
UPD July 14, 13:00 UTC: The domain was restored.
The t.me domain is still down for users worldwide, as it was disabled by the administration of the .me domain zone. The messenger's team has not commented on the matter.
As a temporary measure, users are advised to replace t.me links with telegram.me or telegram.dog — the messenger's official domains.
The @tginfo editors note that Instagram blocks links to telegram.me in profiles, but links to telegram.dog work. Some users report that Instagram bans users from using the “link in bio” feature if the domain is changed, so the best course of action is to wait for the t.me domain to be restored.
Shortly after the news about the domain being disabled, Telegram began replacing t.me links in Telegram apps and on the official telegram.org website. Pavel Durov attempted to contact the .me registry administration via their official Twitter account.
Possible reason for the block
The .me zone belongs to Montenegro, and the infrastructure is managed by a joint venture of Identity Digital, GoDaddy, and the local company ME-net.
The owner of the TeleLakel channel received a response from Identity Digital's support team, which claims that the domain was disabled due to the “need to comply with OFAC-related requirements”.
OFAC is a division of the US Department of the Treasury that administers and enforces economic and trade sanctions.
OFAC has not added Telegram to its sanctions lists. However, an action statement dated July 13, 2026, regarding newly sanctioned companies mentions a service called "FIRST VPN SERVICE". Users noticed that one of the links to its website is a Telegram channel address on the t.me domain.
This could mean that the .me domain operator saw the t.me domain in the sanctions lists and quickly blocked it without further research.
The @tginfo team noticed that this morning the messenger deleted the Telegram channel that was mentioned in this sanctions list. It is unknown whether this channel was actually the reason for the block, or if Telegram did this on their own as a precaution.
A popular rumor about the reason for the block
A version is spreading in the community that the t.me domain was revoked because the official Telegram Twitter account joked about the September 11th terrorist attack.
The @tginfo editors consider this version unlikely: if it were true, the .me domain zone administration would likely have blocked all Telegram domains, including telegram.me. Furthermore, the published image was not a joke invented by the company itself, but one of the most popular entries submitted by users as part of a contest.
⭐ Advanced Text Editor Is Already in Beta
Users with a Telegram Premium subscription and a Beta version of the Telegram app can now send Rich Formatting messages from the new full-screen text editor.
It includes many styling options: headings, tables, LaTeX math formulas, code blocks, block quotes, expandable spoilers, collages, carousel slideshows, and more. We provide more details about the new editor UI in our initial post.
In the past few weeks, the feature only worked on the test server, but is now available to everyone with a Premium subscription. To try the feature at this stage, you must use the Beta versions of the Telegram apps: version 12.9 if you're on mobile (Telegram for Android and Telegram for iOS), or version 6.9.4 of Telegram Desktop.
Beta versions of the Telegram apps:
• Android: official channel
• Telegram Desktop (Windows/macOS/Linux): official website
• iOS: not available for new testers at the moment.
The editor is available under 📎 Attach › Article. Alternatively, in mobile apps you can tap the ↖ icon above the “Send” button.
Subscribe to @betainfo — our second channel. There, our team shares all the new features discovered in the Telegram beta versions.
Extended Text Editor in Telegram
In the beta version of Telegram for iOS, build 12.9.0 (33214), the “AI editor” button was replaced with the Markdown editor launcher.
When tapped, the button expands the message input field to the full screen height, turning it into a full-fledged article editor.
For context, support for extended rich text messages appeared in the Telegram 12.8 update. It includes many text styling options: headings, tables, LaTeX math formulas, code blocks, block quotes, expandable spoilers, collages, carousel slideshows, and more.
Subscribe to @betainfo — our second channel. There, our team shares all the new features discovered in the Telegram beta versions.
Rich Text Formatting is Coming To Users Too
On his Twitter account, Pavel Durov announced that extended Markdown formatting — tables, headers, formulas, task lists, and expandable quotes — will be available not only for bots, but for regular users as well. According to the founder of the messenger, everything will be tested on bots first:
Planned for later this month, but need to test everything on bots first
Telegram for Android and iOS updated to version 12.7
In the May update, the app received a number of useful tools aimed at combating vote manipulation in polls and reaction spammers in groups.
• Custom styles for the AI editor: Telegram now lets you create your own styles within the AI-powered editor. Simply come up with a name, pick an icon from custom emojis, and write a prompt for the language model.
Finished styles can be shared with other users — when opening the link, they'll see examples of how the style transforms text. Creators can also choose to display a link to their profile in the style preview window.
• New poll tools: Administrators can now restrict voting to subscribers who joined the channel at least 24 hours ago. They can also set geographic restrictions, allowing only users from specific countries to participate in a poll.
• Removing reactions in groups: Group admins with the "Delete messages" permission can now remove reactions to any message. To do so, open the full reactions list and long-press the user.
It is also possible to restrict reactions in group chats — either for all members or for a specific user.
• Business bots for all users: Telegram now allows any user to connect business bots to their account, even without Telegram Premium. These bots can automatically handle chats and interact with customers.
Since the launch of Telegram Business in 2024, this feature had been available exclusively to Premium subscribers.
Other changes
• An option to send scheduled messages silently has been added.
• Markdown files (.md) up to 64 KB now open in Instant View mode.
• Poll statistics are now available for polls with at least 100 votes.
• Bots that power automated tools and AI assistants in Telegram can now be invoked directly from the message input field (guest mode support for bots).
Article: telegram.org/blog/ai-bot-revolution-11-new-features/
Download the update
• Android: Google Play, APK from the official website or verified channel.
• iOS: App Store.
#update #Android #iOS
British Regulator Ofcom Launches Investigation into Telegram
The British communications regulator Ofcom has launched an investigation into Telegram regarding its compliance with obligations to combat illegal content under the local Online Safety Act 2023.
According to Reuters, the investigation was prompted by data from the Canadian Centre for Child Protection regarding the spread of child sexual abuse material (CSAM) on the platform, as well as the regulator's own assessment.
If violations are found, platforms could face fines of up to £18 million or 10% of their global turnover.
Telegram's Position
• The messenger "categorically" denies Ofcom's accusations.
• The company claims that since 2018, the public distribution of CSAM on the platform has been "virtually eliminated" thanks to the work of automatic detection algorithms.
• Telegram stated they are surprised by the investigation and concerned that it might be "part of a broader attack on online platforms that defend freedom of speech and the right to privacy".
• A day earlier, Pavel Durov noted that "protecting children" has become a standard PR move for lawmakers to gain control over media narratives.
Context
This is not Telegram's first clash with regulators over CSAM. In February 2025, the Australian regulator eSafety fined the messenger $600,000 for delaying a response to a similar request. In response, the company abandoned its usual passive stance, moved to active legal defense, and sued Australia, challenging the legality of the fine.
At the end of 2024, Telegram officially agreed to cooperate with the Internet Watch Foundation (IWF) — one of the key organizations maintaining CSAM signature databases. Our team has also extensively analyzed Telegram's internal moderation processes based on reports for eSafety: the disclosed documents reveal that photos and videos in all private groups and channels on the platform are automatically scanned against known illegal materials.
Recently, the UK has been consistently ramping up pressure on social media. Earlier this year, to comply with local legislation, Telegram already had to launch an experimental facial age verification system for British users.
It is worth noting that in recent years, under the banner of child protection, European countries have been increasingly pushing requirements that could violate privacy of communications and live. For example, due to requirements from this same Ofcom, Apple was forced to disable E2E encryption for iCloud backups, and the European Union is developing the EU Chat Control law, which is similar to the British OSA in its invasiveness.
#UK #moderation #laws