Search: “TrueConf Server”

U.S. CISA adds TrueConf Server flaws to its Known Exploited Vulnerabilities catalog

CISA added two exploited TrueConf Server flaws (CVE-2026-72529, CVE-2026-72530) to its KEV catalog with federal patch deadlines.

CISA added two TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-72529 (CVSS 9.3), a missing-authentication remote code execution flaw reachable on TCP port 4307, and CVE-2026-72530 (CVSS 9.5), a sandbox escape allowing code execution on the underlying host. Both flaws affect TrueConf Server versions 5.3.x through 5.5.5 and earlier, and were discovered by Vyacheslav Kopeytsev of Kaspersky ICS CERT. Under BOD 22-01, federal civilian agencies must patch CVE-2026-72529 by August 23, 2026, and CVE-2026-72530 by September 2, 2026.

Security Affairs·Aug 21, 08:22 UTC · 26d agoExploit / PoC in the wildCVE-2026-72529CVE-2026-72530

TrueConf Server Flaws Exploited to Replace Client Installers with PhantomCore

Head Mare exploits TrueConf server flaws to install web shells and deliver PhantomCore and PhantomGraph backdoors at Russian organizations.

Kaspersky detected July 2026 attacks by the threat actor Head Mare exploiting a vulnerability chain (KLCERT-26-057 and KLCERT-26-058) in unpatched TrueConf videoconferencing servers. The chain enables arbitrary code execution with SYSTEM privileges, deployment of a web shell at locale.php, and replacement of client installers with versions delivering the PhantomCore backdoor and PhantomGraph, which uses Microsoft OneDrive as C2. Targets span Russian instrumentation, electronics, transport, energy, IT, and software firms. Patches shipped in TrueConf Server 5.3.9, 5.4.9, and 5.5.5 on June 18, 2026.

The Hacker News·Aug 21, 09:43 UTC · 26d agoThreat actor in the wild1

Head Mare APT is exploiting vulnerabilities in an unpatched TrueConf server to deliver PhantomCore and PhantomGraph to video conference participants

Head Mare APT exploits unpatched TrueConf server vulnerabilities to deliver PhantomCore and PhantomGraph backdoors to video conference participants.

Kaspersky discovered malicious TrueConf software installers used by the Head Mare APT group to deploy the PhantomCore and PhantomGraph backdoors. The group exploits vulnerabilities in an unpatched TrueConf server to reach targets. Video conference participants are infected via the trojanized installers.

Kaspersky Securelist·Aug 11, 12:00 UTC · Aug 11, 2026Threat actor in the wild

cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw

cPanel urges administrators to patch CVE-2026-65638, a flaw letting unauthenticated attackers run commands through ConfigServer Firewall's MESSENGER service; update to CSF 16.30.

CVE-2026-65638 in ConfigServer Security & Firewall (CSF) 14.00–16.29 allows unauthenticated remote attackers to execute arbitrary commands via the MESSENGER service, which is exposed only when MESSENGER is enabled and a reCAPTCHA secret has been configured. Exploitation yields command execution under the unprivileged CSF service account, providing a foothold for reconnaissance, data access, or lateral movement on internet-facing cPanel/WHM hosting infrastructure. CSF 16.30 or later fixes the issue; disabling MESSENGER in /etc/csf/csf.conf and restarting csf and lfd is a temporary mitigation.

GBHackers·Sep 11, 11:20 UTC · 4d agoVulnerability 3 sourcesCVE-2026-65638

USN-8761-1: Linux kernel (Azure) vulnerabilities

Ubuntu patches multiple Linux kernel (Azure) flaws across ARM64, Bluetooth, Netfilter, NTFS3, SMB and other subsystems.

Ubuntu security notice USN-8761-1 corrects several security issues in the Linux kernel for Azure, spanning ARM32, ARM64, and PowerPC architectures plus subsystems including Bluetooth, Netfilter, EFI core, GPU drivers, InfiniBand, SCSI, NTFS3, and SMB. An attacker could possibly use these flaws to compromise the system.

Ubuntu Security Notices·Sep 15, 09:42 UTC · 1d agoAdvisory 2 sources

Shared Hosting at Risk: LiteSpeed Enterprise Bug Can Grant Root from a Single Tenant

Critical LiteSpeed Web Server Enterprise flaw (pre-6.3.7) lets a low-privilege shared-hosting tenant escape CageFS isolation and gain root; forced update urged.

cPanel warned that a critical privilege-escalation vulnerability in LiteSpeed Web Server Enterprise (fixed in 6.3.7) lets a malicious low-privilege website user bypass account isolation controls including CloudLinux CageFS and gain root on shared-hosting servers, enabling cross-tenant compromise. No CVE, severity rating, or technical details have been published, and it is unclear whether the flaw is being exploited. This is the third root-level LiteSpeed escape on cPanel servers since May, following CVE-2026-48172 and CVE-2026-54420, which were actively exploited and added to CISA's KEV catalog.

Security Affairs·Sep 15, 12:19 UTC · 22h agoVulnerability 2 sourcesCVE-2026-48172CVE-2026-54420

August 2026 CVE Landscape

Insikt Group catalogs 73 high-impact August 2026 CVEs (43 Very Critical), including PaperCut, Zimbra, and Metabase flaws actively exploited or weaponized.

Recorded Future's Insikt Group identified 73 high-impact vulnerabilities in August 2026, 43 rated Very Critical, spanning 45 vendors with Microsoft accounting for roughly 11%. 31 vulnerabilities surfaced via CISA's KEV catalog, with others validated via open sources, vendor telemetry, and honeypot data. New Nuclei detection templates were released for CVE-2025-62593 (Ray), CVE-2026-72898 (Metabase), and CVE-2026-9198 (IBM Langflow). The report also highlights two AI-assisted operations: UAT-10147 exploited Zimbra, AjaxPro, Nacos, and Telerik servers before using DeepAudit and PentestGPT post-compromise, while a separate Chinese-speaking actor weaponized Hermes Agent and DeepSeek in a failed attempt.

Recorded Future·Sep 8, 00:00 UTC · 8d agoVulnerability in the wildCVE-2025-62593CVE-2026-72898CVE-2026-9198+4 CVEs

Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise Server-Side Request Forgery Vulnerability

Cisco patched an authenticated SSRF flaw in Packaged CCE and Unified CCE that lets credentialed users send arbitrary network requests from affected devices.

A server-side request forgery vulnerability caused by improper input validation of specific HTTP requests affects Cisco Packaged Contact Center Enterprise and Cisco Unified Contact Center Enterprise. An authenticated, remote attacker with valid user credentials can send crafted HTTP requests to make the device issue arbitrary network requests. Cisco has released software updates; no exploitation is reported in the advisory.

Cisco Security Advisories·Aug 19, 16:00 UTC · 27d agoAdvisory

Risky Bulletin: Academics find source code overlaps between Geedge and China's Great Firewall

Academics linked Chinese vendor Geedge Networks' Tiangou Secure Gateway source code to one of the Great Firewall's three traffic filtering capabilities.

US researchers presenting at USENIX Security reconstructed Geedge Networks' Tiangou Secure Gateway firmware from over 100,000 leaked files, including Git repositories with commit history, and matched its filtering behavior to sections of China's Great Firewall. They found only 1 of 3 characterized DNS injectors matched Geedge code, noted the system relies on memory-unsafe C components and copied third-party code, and said its bugs could aid future circumvention tools. Geedge also exports censorship tools to Kazakhstan, Ethiopia, Pakistan, and Myanmar. The newsletter additionally rounds up multiple breaches.

Risky Business News·Aug 21, 02:55 UTC · 26d agoResearch2

CVE-2026-73334: Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation

Apache Parquet Hadoop CVE-2026-73334: a file-controlled KMS URL reaches pluggable KmsClients without host validation in parquet-java 1.12 through 1.18.0.

Apache disclosed CVE-2026-73334, a moderate issue in the org.apache.parquet.crypto.keytools package of parquet-java, versions 1.12 through 1.18.0. The package implements envelope encryption that wraps data keys via a Key Management Service. A KMS URL controlled by the Parquet file is forwarded to a pluggable KmsClient that skips host validation, which could allow crafted files to redirect KMS requests.

oss-security·Sep 8, 15:46 UTC · 7d agoVulnerabilityCVE-2026-733341

VU#943094: ONLYOFFICE ownCloud integration plugin contains a Server-Side Request Forgery (SSRF) vulnerability

ONLYOFFICE's ownCloud integration plugin 9.12 has an SSRF flaw (CVE-2026-84282) letting authenticated admins probe internal networks; no patch exists yet.

CERT/CC published VU#943094 for a server-side request forgery in Ascensio System SIA's ONLYOFFICE ownCloud integration plugin version 9.12, tracked as CVE-2026-84282. The /apps/onlyoffice/ajax/settings/address endpoint does not validate the user-supplied document server URL, so an authenticated administrator can make the ownCloud server send arbitrary requests to localhost and internal hosts. Differences in error responses (connection failures vs SSL/TLS errors) let attackers enumerate open and closed TCP ports for internal reconnaissance. The vendor could not be reached, so no official patch is available; CERT recommends disabling the plugin and applying egress filtering until a fix ships.

CERT/CC Vulnerability Notes·Sep 8, 14:23 UTC · 7d agoVulnerabilityCVE-2026-84282

cPanel LiteSpeed Web Server Vulnerability Allows Shared Server Users to Gain Root-Level Access

Critical LiteSpeed Enterprise flaw fixed in 6.3.7 lets low-privilege shared-hosting users escalate to root and bypass CageFS.

cPanel issued an urgent advisory for a critical privilege escalation in LiteSpeed Web Server Enterprise versions before 6.3.7, allowing a low-privilege shared-hosting account to gain root-level server control and bypass tenant isolation controls including CloudLinux CageFS. Root access would let attackers access other hosted sites, steal databases and credentials, deploy phishing pages, and install backdoors. Administrators are urged to upgrade to 6.3.7 immediately via lsup.sh and to review privileged account activity, cron jobs, SSH keys, and system binaries; no CVE identifier was published.

Cyber Security News·Sep 15, 13:52 UTC · 21h agoVulnerability

ZDI-26-695: Linux Kernel NFSv4 Server Race Condition Remote Code Execution Vulnerability

ZDI-26-695: Linux Kernel NFSv4 server race condition (CVE-2026-89688, CVSS 8.5) enables remote code execution on nfsd systems with authentication.

ZDI advisory ZDI-26-695 describes a race condition in the Linux Kernel NFSv4 server tracked as CVE-2026-89688 with a CVSS score of 8.5. Remote attackers can execute arbitrary code, but authentication is required and only systems with nfsd enabled are vulnerable. No in-the-wild exploitation is mentioned in the advisory.

ZDI Published Advisories·Sep 14, 05:00 UTC · 2d agoVulnerabilityCVE-2026-89688

Linux Foundation takes on TRACE, a hardware-backed runtime evidence specification for AI agents

The Linux Foundation adopts TRACE, an OPAQUE-contributed spec giving AI agents hardware-attested, cryptographically verifiable runtime and compliance evidence.

The Linux Foundation accepted the TRACE (Trust, Runtime Attestation and Compliance Evidence) specification contributed by OPAQUE, developed with AMD, Intel, Microsoft, and the Technology Innovation Institute. TRACE binds runtime environment, software, policies, data classifications, and tool usage into a portable, cryptographically verifiable artifact, composing existing standards such as RATS, EAT, SLSA, SCITT, SPIFFE, and EAR. It recorded nearly 135,000 PyPI downloads within 10 weeks of its June 2026 introduction, and its technical workstream will be hosted by the Coalition for Secure AI.

Help Net Security·Aug 26, 00:00 UTC · 21d agoAI tools & infra

CVE-2026-73668: Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values

Apache Syncope cross-realm authorization flaw lets administrators read confidential ConnId bundle configuration values from realms they should not access (CVE-2026-73668).

CVE-2026-73668 is an incorrect authorization vulnerability in Apache Syncope allowing an administrator with entitlements in one realm to view confidential ConnId bundle configuration values belonging to other realms. Affected component is syncope-core-idm-logic 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2. Apache rates the issue moderate severity.

oss-security·Sep 14, 15:34 UTC · 1d agoVulnerability 3 sourcesCVE-2026-73668

CVE-2026-59969: Apache ZooKeeper: Improper validation of certificate with host mismatch in FIPS mode

CVE-2026-59969: Apache ZooKeeper quorum TLS skips peer hostname verification in FIPS-mode deployments, enabling potential server-to-server impersonation.

Apache ZooKeeper versions 3.8.0-3.8.6 and 3.9.0-3.9.5 fail to enforce peer hostname verification for quorum TLS when FIPS mode is enabled with sslQuorum, zookeeper.fips-mode, and hostname verification settings turned on. The flaw is rated important and could allow an attacker to impersonate a quorum peer via certificate host mismatch. Users should upgrade to fixed versions.

oss-security·Sep 15, 18:23 UTC · 16h agoVulnerabilityCVE-2026-59969

ConnectWise warns of new ScreenConnect flaw without patch

ConnectWise warns of an unpatched ScreenConnect flaw affecting file transfer in support sessions and shares interim mitigations for MSPs.

ConnectWise disclosed a new ScreenConnect Remote Access vulnerability affecting file transfer behavior in both cloud and on-premises deployments; no CVE ID or patch is available yet, with a fix planned later this week. The vendor published temporary mitigation steps that remove TransferFiles permissions from session groups across all roles. Shadowserver tracks nearly 6,000 internet-exposed ScreenConnect instances. Previous ScreenConnect flaws, including CVE-2024-1709, were exploited by ransomware gangs and North Korea's Kimsuky, and three ScreenConnect vulnerabilities are on CISA's actively exploited catalog.

BleepingComputer·Sep 7, 10:06 UTC · 9d agoVulnerabilityCVE-2024-1709CVE-2025-3935CVE-2026-35641

[webapps] Linuxfabrik monitoring_plugins_6.0.0 - SSRF

A public proof-of-concept exploit for an SSRF flaw in Linuxfabrik monitoring_plugins 6.0.0 appeared on Exploit-DB.

Exploit-DB listing 52653 discloses a server-side request forgery (SSRF) vulnerability in Linuxfabrik monitoring_plugins version 6.0.0, classified under web applications. A proof-of-concept exploit is publicly available. No CVE identifier or evidence of in-the-wild exploitation is provided in the listing.

Exploit-DB·Aug 18, 00:00 UTC · 29d agoExploit / PoC

CVE-2026-86304: MojoX::Authentication versions before 0.006 for Perl allow SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor

MojoX::Authentication before 0.006 for Perl allows SAML authentication bypass because parse_assertion builds Net::SAML2::Binding::POST without a trust anchor (CVE-2026-86304).

CVE-2026-86304 affects MojoX::Authentication versions before 0.006 for Perl. The parse_assertion function builds Net::SAML2::Binding::POST without a trust anchor, so SAML assertions are not validated against a trusted signing key, enabling authentication bypass. The flaw is fixed in version 0.006 of the module.

oss-security·Sep 6, 23:14 UTC · 9d agoVulnerabilityCVE-2026-86304

New Guidance Helps Businesses Verify Quantum-Safe Hardware Claims

TCG issued guidance to help businesses verify that trusted platform modules genuinely meet quantum-safe requirements.

The Trusted Computing Group (TCG) published new guidance aimed at proving that trusted platform modules (TPMs) genuinely satisfy essential quantum-safe requirements. The document gives businesses a way to validate vendor claims about post-quantum readiness in hardware security rather than trusting marketing assertions. This is a guidance publication, not an incident or vulnerability disclosure.

Infosecurity Magazine·Aug 24, 16:00 UTC · 22d agoAdvisory

Access Control as Verified Parse Constraints

Researchers verify a class of EverParse validators that correctly enforce access-control policies, deploying a machine-checked enforcement gate on seL4.

The paper targets enforcement-code bugs in commercial security gateways by proving that forward-only, backtrack-free EverParse validators are verified recognizers for a bounded finite-state class that includes access-control decision functions with fixed-offset fields and bounded disjunction. Encoding a bounded policy language into a fixed-size byte buffer allows an SMT solver to verify the enforcement code once, covering all byte values, policies, requests, and sessions. Editing rule content over a fixed endpoint set requires no new proof, while adding endpoints reruns the toolchain. A deployment on the seL4 microkernel ensures every request passes through the gate and unverified components cannot corrupt the enforcement chain.

arXiv cs.CR·Sep 11, 06:33 UTC · 5d agoResearch

SMOKE#SCREEN Campaign Abuses ScreenConnect to Give Attackers Remote Control Access

Security Affairs·Aug 9, 11:05 UTC · Aug 9, 2026Threat actor1

Dell Secure Connect Gateway Critical Flaws Allow Unauthenticated Remote Code Execution and Admin Access

Dell patched three critical Secure Connect Gateway flaws (CVE-2026-80172 up to CVSS 9.8) enabling unauthenticated admin access, remote code execution, and host takeover.

Dell Security Advisory DSA-2026-382 fixes three critical vulnerabilities in Secure Connect Gateway (SCG) 5.0, affecting appliances earlier than 5.36.00.16 and applications earlier than 5.36.00.00. CVE-2026-80172 (CVSS 9.8) allows unauthenticated replay of captured requests to obtain ADMIN access due to missing nonce and time validation; CVE-2026-61410 (9.4) enables unauthenticated command execution via missing authorization; CVE-2026-80238 (9.3) involves an exposed Docker socket allowing root access and container escape. Dell urges immediate upgrades and recommends restricting management interfaces to trusted networks and rotating credentials if compromise is suspected.

GBHackers·Sep 8, 12:04 UTC · 7d agoVulnerabilityCVE-2026-80172CVE-2026-61410CVE-2026-80238

Next.js 16.4.0-canary.13 Image Optimizer DNS Rebinding TOCTOU SSRF Still Exists

Next.js 16.4.0-canary.13 Image Optimizer retains a DNS rebinding TOCTOU SSRF in fetchExternalImage() allowing requests to private network resources.

Next.js 16.4.0-canary.13 contains a DNS rebinding time-of-check-to-time-of-use Server-Side Request Forgery vulnerability in the Image Optimizer's fetchExternalImage() function. The code resolves the supplied hostname and checks the resulting addresses with isPrivateIp(), but a TOCTOU gap between resolution and the actual fetch allows an attacker-controlled DNS record to change and reach private network resources.

Full Disclosure·Sep 4, 00:13 UTC · 12d agoVulnerability

Modified ScreenConnect Clients Used in Worm-Like Campaign

Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.

Campaigns starting in late August use social engineering, including Quick Assist abuse, to install rogue ScreenConnect clients that spawn wscript.exe and deploy four VBScript files for reconnaissance, staging, and PowerShell execution. The attackers persist via User Run Keys, attempt UAC bypass, install UltraViewer, and propagate the VBScript chain to other connected ScreenConnect endpoints. ConnectWise published an advisory about a file transfer behavior issue affecting cloud and on-premises ScreenConnect, with a CVE identifier and fix expected within a week; it recommends disabling file transfer meanwhile.

SecurityWeek·Sep 7, 11:45 UTC · 8d agoExploit / PoC in the wild

ZDI-26-569: Linux Kernel Net Scheduler True Link Equalizer Race Condition Local Privilege Escalation Vulnerability

ZDI publishes ZDI-26-569, a CVSS 7.5 race condition local privilege escalation in the Linux kernel net scheduler true link equalizer.

The Zero Day Initiative disclosed a race condition in the Linux kernel's net scheduler true link equalizer component enabling local privilege escalation. Exploitation requires the attacker to first run high-privileged code on the target system. The advisory carries a CVSS rating of 7.5; no CVE id is listed in the disclosure text.

ZDI Published Advisories·Aug 13, 05:00 UTC · Aug 13, 2026Advisory

Top 10 Best Serverless Security Solutions in 2026

Buyer's guide ranks Palo Alto Prisma Cloud and Aqua top for serverless security; standalone serverless security has largely folded into CNAPP platforms.

A top-ten listicle evaluates serverless security tools across FaaS platforms like AWS Lambda, Azure Functions, and Google Cloud Functions. Prisma Cloud and Aqua lead platform coverage, Snyk owns code/dependency scanning, and Sysdig covers runtime behavior. The guide's main conclusion is that the standalone serverless security category has largely consolidated into CNAPP platforms.

Cyber Security News·Sep 15, 06:48 UTC · 1d agoIndustry

Permify: Open-source authorization as a service

Help Net Security profiles Permify, an open-source Zanzibar-style authorization service supporting RBAC, ABAC, and relationship-based rules with multi-tenant deployments.

Permify is an open-source authorization-as-a-service project modeled on Google Zanzibar that centralizes access-control decisions outside application code. It supports role-based, relationship-based, and attribute-based access rules, answers checks in tens of milliseconds via REST and gRPC, and runs from a single Docker command. It is a CNCF member and is freely available on GitHub.

Help Net Security·Sep 14, 05:30 UTC · 2d agoTools1

Stealth rootkit targeting F5 BIG-IP could expose enterprise identity gateways

Sophos analyzed a stealth Linux rootkit that hides a web shell in memory on compromised F5 BIG-IP APM identity gateways, evading file-based detection.

Sophos analyzed a second-stage Linux rootkit implant found in compromised F5 BIG-IP APM environments running Apache and PHP, linked to exploitation of CVE-2025-53521, an unauthenticated RCE. The implant hooks Apache's PHP-loading process and serves modified in-memory versions of three legitimate webtop PHP files (apm_css.php3, full_wt.php3, webtop_popup_css.php3), leaving on-disk files untouched so hashes and integrity checks pass. It also establishes access via an authenticated local UNIX socket that can provide an interactive /bin/bash session. Experts warn compromised APM appliances, which handle federated SSO and terminate TLS at enterprise perimeters, could enable SSO token theft and lateral movement to trusted downstream applications.

CSO Online·Sep 10, 11:51 UTC · 5d agoMalware in the wild 2 sourcesCVE-2025-53521