60
Google fixes actively exploited Zero
60
60
60
60
60
60
60
60
60
60
Researchers Build WeChat Zero-Click Worm Hijacking Phones via Calls
Calif researchers built WeWorm, a zero-click worm exploiting a WeChat VoIP memory-corruption RCE that Tencent has now patched.
Calif researchers found a memory corruption flaw in WeChat's VoIP stack in July using LLM-assisted analysis and built working exploits within two days, then integrated them into WeWorm, which they call the first zero-click worm spreading through WeChat calls on iOS and Android. A crafted incoming call yields remote code execution with no user interaction, giving full control of the victim's WeChat account; the attacker only needs to be on the victim's friend list, easily achieved by compromising a contact first. Tencent confirmed the bug and shipped patches in WeChat Android 8.0.77 and iOS 8.0.76, and chaining with other OS bugs could yield full device control.
62
60
⚡ Weekly Recap: Fortinet Exploited, China's AI Hacks, PhaaS Empire Falls & More
60
60
60
U.S. CISA adds Linux kernel and VMware ESXi and Workstation flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
60
60
45
57
60
60
60
50
60
60
45
57
60
WeChat Worm Can Hijack Accounts Without Victims Answering Calls
Researchers demoed WeWorm, a zero-click WeChat worm hijacking accounts via incoming VoIP calls using a memory corruption flaw; Tencent patched it in August.
Researchers at Calif exploited a memory corruption bug in WeChat's VoIP system, taking over accounts through an incoming call even if the victim never answers or touches the phone. The attacker must already be a WeChat contact, but compromising a friend's account bypasses this, and chained calls spread the worm across three Android and iOS test phones in seconds. Tencent fixed the flaw in Android 8.0.77 and iOS 8.0.76 released in August, and researchers found no evidence of real-world exploitation. WeChat and Weixin reported 1.418 billion combined monthly active users at the end of 2025.
66
Week in review: Exploited zero-day in Cisco email security appliances, Kali Linux 2025.4 released
60
Samsung Mobile Flaw Exploited as Zero
60
60
Google’s August Patch Fixes Two Qualcomm Vulnerabilities Exploited in the Wild
60
57
60