Over the past few hours I've received several messages about a possible RCE in AyuGram Desktop. Two people who say they were affected contacted me directly. One couldn't provide any useful details; the other had downloaded and run a malicious executable themselves.

Since then I've audited the full codebase several times and found nothing in AyuGram's changes that could allow remote code execution. A few people who audited it independently came to the same conclusion. They did point out one issue: in some cases the confirmation wasn't shown for links to local or network files. This couldn't be abused through messages - I tested it, and Telegram strips such links for both users and bots. Still, I've hardened link handling.

I'm also releasing an update based on the latest upstream version, with several memory bugs and crashes fixed, in case outdated dependencies or older upstream code played any part.

Also, I haven't forgotten about the 35 open pull requests on GitHub. I'll review them and merge or close them soon; I just haven't had the time yet, sorry.
Android update will be released later today.

As always, download AyuGram only from official sources: GitHub or @AyuGramReleases.