A now-fixed Telegram flaw could help an attacker take over an Android phone through a call when combined with other bugs. Here are 10 simple steps for home, work, and travel.
AppWT Informative Multi-Lingual System
A security company found a flaw in Telegram for Android that, when combined with other bugs, could let an attacker take over a phone after the person answers a voice call. Telegram fixed it in version 12.10.4. Check your app version today, and think twice before you answer calls from strangers in any chat app.
What happened with Telegram
On October 29, a security startup called NebuSec shared details of the flaw, as reported by The Hacker News. A flaw is a mistake in an app's code that someone could misuse. NebuSec said this flaw could be joined with two other bugs. Together, they could give an attacker full control of an Android phone, including its messages, microphone and camera.
Here are the key facts from the report:
- The attacker only needed a normal Telegram account.
- The victim had to answer the call. Declining the call stops the attack.
- Versions 8.6.2 through 12.10.3 can trigger the flaw. Those came out between March 2022 and September 2026.
- Version 12.10.4, released in late September, fixes it.
- NebuSec has not seen the flaw used in real attacks.
- NebuSec has no evidence so far that it directly affects Telegram on iPhone, on desktop computers or in group calls.
Telegram acknowledged the report. According to NebuSec, Telegram did not think the flaw could run code outside the app. No technical write-up was posted as of October 29, so details of the full attack come from the company's video and statements.
Tips for you and your family
Tip 1: Check your Telegram version
Open Telegram on your Android phone. Go to Settings and scroll to the bottom. The version number is shown there. It should say 12.10.4 or higher. If it does not, update the app from your app store.
Tip 2: Turn on automatic app updates
A fix only helps once it reaches your phone. Turn on automatic updates in your app store settings. Then fixes like this one arrive without you having to remember.
Tip 3: Limit who can call you
Telegram has a call privacy setting. The report says that setting it to "Nobody" blocks this attack. If you rarely use Telegram calls, this is a simple step.
Tip 4: Let unknown calls ring
This attack only worked if the person answered. Make a family rule. If a chat app call comes from someone you do not know, do not pick up. Send a text message instead if you think the call may be real.
Tip 5: Check phones for others in your home
Children and older relatives may not follow security news. Sit down with them for five minutes. Check their app versions and call settings together.
Tips for a small business
Tip 6: Ask staff to check work phones
If people on your staff use Telegram on Android for work, send a short note today. Ask each person to confirm they have version 12.10.4 or later. Keep a simple list of who has checked.
Tip 7: Update soon, not someday
A Hacker News webinar notice says AI is increasing the speed at which weaknesses can be found and used. AI means computer programs that can do tasks on their own. So the time you have to install a fix may be shorter than before. Pick one day each week to check that work phones, computers and apps are up to date.
Tips for travelers
Tip 8: Download language packs before you leave
WIRED notes that free apps such as Google Translate, Apple Translate and DeepL Translate can translate common phrases. For many common languages, you can download a language file ahead of time. Then the app still works when you have no internet connection.
Tip 9: Hand strangers a separate device, not your phone
When you talk with someone through a translator, you may need to pass the device back and forth. WIRED points out that a stand-alone handheld translator lets you keep your phone free for photos or notes. You may also feel more comfortable handing a less costly device to someone you do not know. Some models show the other person's side of the talk upside down on the screen, so you pass it less often.
Tip 10: Update apps before your trip
Before you travel, update your phone and your chat apps at home, on a network you trust. That way you leave with the latest fixes, including the Telegram fix if you use the app.
Have a question about anything here? Email me at sales@appwt.com or call (888) 565-0171, and I will answer it.
Sources
- Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls, The Hacker News, 2026-10-29
- Webinar: How to Build AI Threat Readiness Into Your Security Operations, The Hacker News, 2026-10-29
- The Best Handheld Translators for Work and Travel (2026), WIRED, 2026-10-30
Tags
Frequently Asked Questions
Is Telegram on my iPhone affected?
NebuSec said it has no evidence so far that the flaw directly affects Telegram's iOS or desktop apps. It confirmed the problem in private voice calls on ARM64-based Android phones.
How do I know if my Telegram app is safe?
Open Settings in Telegram and look at the bottom of the page for the version number. Version 12.10.4 or later has the fix.
Has anyone been attacked this way?
NebuSec said it has not seen the flaw used in real attacks.
What if I cannot update right away?
The report says setting Telegram's call privacy option to "Nobody" blocks the attack. Declining the call also blocks it.
Do I need internet to use a translation app abroad?
Not always. WIRED says that for fairly common languages, you can download the language file and use the app offline.
Enjoyed this article?
Share it with your network
