New Zoom Flaws Could Let Attackers Hack Victims Just by Sending them a Message
60
60
Zoom Patches “Zoomsday” Zero-Click Flaw Enabling Remote Code Execution
Zoom patched CVE-2026-53413, a zero-click annotation flaw dubbed "Zoomsday" allowing remote code execution on meeting participants' devices across all platforms.
Zoom patched four vulnerabilities, including CVE-2026-53413, a stack buffer overflow in CAnnoFormatBlock::Deserialize in the annotation protocol that allows zero-click remote code execution on another participant's device. A Security also found CVE-2026-53414, a buffer overread enabling denial-of-service crashes, and CVE-2026-53415, a use-after-free Zoom had already discovered internally. Updates shipped for Workplace 7.1.5 and 7.0.6, Rooms 7.1.5, and Meeting SDK 7.1.5 across all supported platforms.
70
Microsoft's January 2024 Windows Update Patches 48 New Vulnerabilities
60
60
Microsoft's July Update Patches 143 Flaws, Including Two Actively Exploited
60
Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands
CERT-UA says Sandworm-linked UAC-0145 poses as recruiters in fake job interviews to deliver a trojanized WireGuard VPN that runs attacker commands on victims' hosts.
CERT-UA attributes the campaign, ongoing since May 2026, to UAC-0145, a subgroup within GRU-affiliated Sandworm (APT44). Posing as HR staff of firms like ATLAS Business Group and Sopra Steria Bulgaria, attackers lure Ukrainian IT specialists into Zoom interviews, then share failing WireGuard configs and push a custom SopraVPN client from SourceForge. The modified WireGuard build supports a non-standard SymmetricKey option holding AES-256-GCM-encrypted PowerShell, decrypted with the decoded PrivateKey and executed via runScriptCommand. A scheduled task then downloads a second-stage payload on Windows, while the Linux variant fetches it via cURL.
72
60
60
60
3 Actively Exploited Zero-Day Flaws Patched in Microsoft's Latest Security Update
60
60
Microsoft Rolls Out Patches for 80 New Security Flaws — Two Under Active Attack
60
Microsoft Patches 130 Vulnerabilities, Including Critical Flaws in SPNEGO and SQL Server
60
60
60
Microsoft Fixes 80 Flaws — Including SMB PrivEsc and Azure CVSS 10.0 Bugs
60
Microsoft Fixes 149 Flaws in Huge April Patch Release, Zero
60
60
⚡ Weekly Recap: NFC Fraud, Curly COMrades, N
60
Desktop and IoT threat report for Q2 2025
60
60
⚡ Weekly Recap: WordPress RCE, SonicWall 0-Days, AI Service Attacks, SharePoint 0
60
60
60