Weekly brief, 2026 week 42

This issue collects seven stories from 3 to 11 October.

File-reading flaw in Telegram Desktop

A researcher disclosed on 3 October a flaw in Telegram Desktop 7.2.8 and earlier: a single click on a crafted link outside Telegram could send local files to an attacker. The files could include login data that let the attacker take over the account, and the researcher confirmed it only on Windows. The researcher writes that a Telegram commit on GitHub on 16 September fixed the problem and that 7.2.9, released on 17 September, includes the fix, though the official release notes mention only an unrelated rendering fix.

Telegram Desktop users can check that they are on 7.2.9 or later. The researcher also suggests setting a local passcode, while noting that it only makes stolen login data unusable and does not stop files from being read.

Bitwarden's store builds move to a commercial licence

A Bitwarden staff member announced on the community forum on 9 October that, starting with the next release, the apps published in app stores will be the commercially licensed builds. In replies, staff added that direct downloads from the website will also be commercially licensed. The announcement says the GPLv3 open-source version will continue to be updated and published on GitHub and that all current features are in both versions, but a staff reply also says some future components will be published under the commercial licence and exist only in that build.

Another staff member wrote on the forum that the change only affects those repackaging and reselling Bitwarden and that self-hosting is unaffected. As of 12 October, the licence file on GitHub was last changed in 2025. It still covers GPLv3 plus the Bitwarden License, which applies only to the bitwarden_license directory, and we could not find the commercial build's licence text on the website.

LineageOS 24

LineageOS, an operating system built on Android's open-source code that users can install on their own phones, announced version 24.0, based on Android 17, on its official blog on 11 October. It launches for a selection of devices, with more added as they meet the project's requirements. For devices on Linux kernels 4.4 and 4.9, the project only accepts 22.2 builds, which the blog says will keep receiving monthly security patches until Google stops publishing official security bulletins for Android 15.

Users already on an official build can follow their device's upgrade guide and do not need to wipe their device unless its wiki page says otherwise.

Nitter seeks funding and legal help

According to its README, Nitter is a free and open-source alternative front end for X (Twitter) focused on privacy. Its maintainer posted on nitter.net on 10 October that X Corp. sent cease-and-desist letters on 24 August and 8 September demanding a permanent takedown of Nitter instances and the project's repository. The post says the maintainer's 7 September update about having legal representation relied on assurances that turned out to be untrue. As of the 10 October post, Nitter has no legal counsel, and the maintainer is seeking funding and legal help.

TechCrunch reported in August that the letter accused Nitter of unlawful use and circumvention of X's API. As of 12 October, nitter.net shows only the announcement.

A DNS ad blocker built on an ESP32-C3

The open-source GitHub project esp32-c3-adblock puts Pi-hole-style DNS ad blocking on an ESP32-C3 board, which its README puts at about US$2, under the MIT licence. The project was still being updated as of 6 October, and the README says lookups for blocklisted domains are answered with 0.0.0.0 while others are forwarded to an upstream DNS server. You point a device's DNS at the board, and the README's install steps involve compiling and flashing it yourself.

The README warns that leaving the default passwords in place makes the dashboard password effectively public, and that the dashboard runs over plain HTTP. Our reading of the main branch code on 12 October is that by default it forwards queries unencrypted to the public DNS service Quad9.

Mobile internet shutdown and a platform advisory in New Delhi

According to the Deccan Herald, India's Ministry of Home Affairs authorised a suspension of mobile internet services, covering all mobile technologies, within a 4 km radius of the Janpath–Kartavya Path crossing in New Delhi. The authorised window was 22:00 India time on 9 October to 22:00 on 10 October, coinciding with a protest. MediaNama reported that the order was marked top secret and did not state its grounds, and as of its 12 October update the ministry had not officially published it.

According to the full text published by MediaNama, the Ministry of Electronics and Information Technology issued an advisory on 8 October advising social media platforms to exercise enhanced diligence over false and misleading content that could affect public order and to prioritise reports from authorised government agencies. As of 12 October, the advisory was not on the ministry's website.

The digital rights group SFLC.IN argues that the shutdown was disproportionate and that not publishing the order beforehand breached the publication requirement in the Telecommunications (Temporary Suspension of Services) Rules, 2024. SFLC.IN also argues that the advisory's broad, vague wording could push platforms to over-remove lawful speech to protect their safe-harbour status.

Psiphon and Canada's Bill C-22

The Globe and Mail reported on 4 October that Psiphon, a Toronto company that helps users get around online censorship, told the paper it has started planning to move its operations out of Canada if the lawful access bill C-22 (Lawful Access Act, 2026) passes as written. The Citizen Lab's page says the bill would require electronic service providers to make secret changes to their systems to give police and intelligence services surveillance capabilities. A Psiphon vice-president wrote in an email reply to the paper that a secret backdoor cannot be built into open-source code because every line is public. As of 12 October, Psiphon's own website had no separate announcement.

In the same report, a spokesperson for the public safety minister said a lawful access framework does not, on its own, make it impossible to operate a secure, privacy-protective service in Canada. The report also notes that the House of Commons amended the bill before the summer recess, including an amendment protecting end-to-end encryption. As of 12 October, Parliament's LEGISinfo shows the bill at second reading in the Senate.