45
45
45
45
WeWorm – First 0-Click Worm Spreading Through WeChat Calls Across iOS and Android
Researchers demonstrated WeWorm, a zero-click worm exploiting a memory-corruption flaw in WeChat's VoIP stack to spread via calls across iOS and Android.
Security firm Calif published WeWorm, a proof-of-concept zero-click worm exploiting a memory-corruption bug in WeChat's VoIP stack to spread through voice calls on iOS and Android without the victim answering. The demo chained a Pixel 10a, an iPhone 17e, and a second Pixel 10a, compromising each device while the call was still ringing and giving full control of the WeChat account. The attacker must already be on the victim's friend list, but compromised contacts become the propagation layer across a platform with over 1.4 billion monthly users. Calif reported the bug to Tencent in July 2026, and Tencent has since mitigated it; full technical details are withheld for a later conference presentation.
68
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
45
Apache Superset SQL Injection Flaw Gets Public PoC Exploit
A public Python proof-of-concept exploit was released for CVE-2026-23980, an authenticated error-based SQL injection flaw in Apache Superset before 6.0.0.
A public proof-of-concept exploit repository now targets CVE-2026-23980, an error-based SQL injection affecting Apache Superset versions from 0.0.0 up to but not including 6.0.0. An authenticated user with read access can inject SQL through the sqlExpression or where parameters, potentially reaching business, customer, and security data depending on database configuration and privileges. Apache disclosed the flaw in February and urges upgrading to Superset 6.0.0; compensating controls include least-privilege database accounts, network restrictions, and log monitoring.
52
Researcher Publishes CrowdStrike Privilege Escalation Zero Day
Researcher NightmareEclipse published FalconFlank, a zero-day local privilege escalation in CrowdStrike Falcon Sensor abusing its Office malicious macro remediation feature.
A researcher known as Nightmare Eclipse published details of FalconFlank, a zero-day privilege escalation that abuses the Microsoft Office malicious macro removal feature in CrowdStrike Falcon Sensor, verified working on fully updated Windows 11 25H2 and Windows Server 2025 with Falcon Phase 3 Optimal Protection. CrowdStrike urged customers to disable the Office File Suspicious Macro Removal policy while it investigates, noting customers remain protected via Cloud Anti-malware for Microsoft Office Files; no CVE has been assigned. The same researcher previously released the Exploitarium dump of over 30 PoC exploits, and researcher Kevin Beaumont confirmed FalconFlank works.
62
50
50
50
45
45
45
45
50
45
45
50
45
45
50
45
50
45