ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Calif”

50 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 152Policy & legal 61Ransomware 37Data breach 30Threat actor 27Phishing & fraud 26Vulnerability 25Malware 22Industry 10Advisory 3AI safety & security 3AI industry 3AI tools & infra 2AI policy 2
SeverityAllcritical 273high 50medium 23low 43info 14

WeChat worm could pwn a friend before they even answered the call

Calif researchers demoed WeWorm, a zero-click WeChat VoIP memory-corruption worm enabling account takeover; Tencent patched it August 21.

Security firm Calif found a memory corruption bug in WeChat's VoIP stack that let a trusted contact take over a user's account simply by calling them, without the call being answered. The demo worm then called the victim's contacts to self-propagate across iOS and Android; declining the call prevented infection. Tencent pushed fixes on August 21, and Calif said chaining the bug with other Android and iOS flaws could yield full device control. Calif used AI to find the vulnerability and build its first RCE exploit in about two days.

The Register · Security · 7d agoExploit / PoC

WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls

Researchers demonstrated a zero-click WeChat worm that hijacked accounts via incoming calls; Tencent blocked the exploit server-side after July disclosure, no real attacks reported.

Security firm Calif built a worm that seized WeChat accounts via incoming calls without any target interaction, demonstrating it spreading across three test phones (Android to iPhone to Android). Once exploited, the attacker gains full control of the WeChat account, including messages, calls, payments, and mini programs, though not the phone itself. Tencent mitigated the flaw server-side, confirmed blocked on 28 August, shipping WeChat 8.0.77 for Android and 8.0.76 for iOS on 21 August. No CVE has been assigned, Tencent published no advisory, and no attacks in the wild have been reported; WeChat/Weixin counts 1.439 billion monthly active users.

The Hacker News · 8d agoVulnerability1

The vulnpocalypse rains iBugs down on Apple with record-setting number of patches

Apple's record patch cycle fixes 260+ CVEs across iOS 27 and macOS 27, including CUPS remote code execution, with no active exploitation reported.

Apple patched more than 260 CVEs across its operating systems and software, its largest single patch cycle ever, with iOS 27 fixing 122 flaws and macOS 27 Golden Gate fixing 204. Notable bugs include CVE-2026-43692, a CUPS validation issue allowing remote code execution, and CVE-2026-43689, an iOS privilege-escalation flaw granting root access. Ten CVEs were credited to AI-assisted bug hunting, including CVE-2026-65410 and CVE-2026-65409 found by Calif with Claude and Anthropic Research. None of the vulnerabilities are listed as actively exploited.

The Register · Security · 15h agoVulnerabilityCVE-2026-65410CVE-2026-65409CVE-2026-43689+10 CVEs

WeChat Worm Can Hijack Accounts Without Victims Answering Calls

Researchers demoed WeWorm, a zero-click WeChat worm hijacking accounts via incoming VoIP calls using a memory corruption flaw; Tencent patched it in August.

Researchers at Calif exploited a memory corruption bug in WeChat's VoIP system, taking over accounts through an incoming call even if the victim never answers or touches the phone. The attacker must already be a WeChat contact, but compromising a friend's account bypasses this, and chained calls spread the worm across three Android and iOS test phones in seconds. Tencent fixed the flaw in Android 8.0.77 and iOS 8.0.76 released in August, and researchers found no evidence of real-world exploitation. WeChat and Weixin reported 1.418 billion combined monthly active users at the end of 2025.

Security Affairs · 7d agoExploit / PoC

FreeIPA Flaw Chain Lets Anonymous Clients Create Reusable Administrator Credentials

Critical FreeIPA flaw chain (CVE-2026-76578, CVSS 9.8) lets anonymous clients create reusable admin credentials on default installs; fixed in 4.13.4.

Red Hat warns that chaining FreeIPA's CVE-2026-76578 (CVSS 9.8) with a 389 Directory Server flaw (CVE-2026-76560, CVSS 7.5) lets an anonymous client write a Kerberos identity into the directory and land in the administrators group on default installations; Red Hat reproduced the chain twice, including on a machine with no access at all. FreeIPA 4.13.4 fixes both flaws, and fourteen 389-ds advisories shipped September 8, with RHSA-2026:64785 rated critical. A separate flaw, CVE-2026-79678 (CVSS 8.1), allows reading the server's environment variables one at a time via a Python eval() in idp-add, potentially exposing Directory Manager and administrator passwords in container installs. No real-world exploitation has been reported.

The Hacker News · 8d agoVulnerabilityCVE-2026-76578CVE-2026-76560CVE-2026-79678+1 CVEs

“Zero-click” WeChat worm could hijack accounts and spread via a single call

Researchers discovered a critical memory corruption flaw in WeChat's VoIP stack enabling a zero-click worm, WeWorm, that hijacks accounts via calls; Tencent patched it.

Calif researchers weaponized a memory corruption issue in WeChat's VoIP stack into "WeWorm", a worm that spreads through WeChat calls without user interaction, hijacks each victim's account, and propagates via saved contacts across iOS and Android, potentially reaching millions of devices within hours. Exploitation takes seconds and grants full account control, and chaining with other reported Android/iOS bugs could lead to full device control. Tencent issued updated WeChat versions for iOS and Android and applied server-side mitigations; technical details remain withheld. WeChat has over a billion users, overwhelmingly in China.

Help Net Security · 7d agoVulnerability