Reported by 5 outlets

Timeline

1. update from malware.news

   TrueConf security advisory (AV26-835)

   malware.news · 54d ago · August 20th, 2026

   Serial Number: AV26-835 Date: August 20, 2026 As of August 19, 2026, TrueConf is affected by a vulnerability in the following product: TrueConf Server 5.3.x versions prior to 5.3.9 5.4.x versions prior to 5.4.9 5.5.x versions prior to 5.5.5 On August 20, 2026, Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-72529 and CVE-2026-72530 to their Known Exploited Vulnerabilities (KEV) Database. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. TrueConf Security Vulnerabilities, Fixes and Advisories CISA KEV: CVE-2026-72529 CISA KEV: CVE-2026-72530 Article Link: TrueConf security advisory (AV26-835) - Canadian Centre for Cyber Security

2. update from securityweek.com

   CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities

   securityweek.com · 53d ago · August 21st, 2026

   Virtual Event Today: CodeSecCon - Learn to Secure Your Software > Join Event

3. update from gbhackers.com

   Head Mare APT Exploits TrueConf Server RCE Flaws to Deliver PhantomCore Malware

   gbhackers.com · 53d ago · August 21st, 2026

   The Head Mare APT group has been linked to a supply chain compromise involving unpatched TrueConf Server instances, which enabled the delivery of PhantomCore malware to video conference participants. Kaspersky researchers identified this activity while investigating attacks against Russian organizations. Attackers hosted legitimate-looking TrueConf client installers on compromised servers that silently deployed the remote-access malware […] The post Head Mare APT Exploits TrueConf Server RCE Flaws to Deliver PhantomCore Malware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from cyberpress.org

   Head Mare Exploits TrueConf Flaws to Deliver PhantomCore Malware to Meeting Participants

   cyberpress.org · 53d ago · August 21st, 2026

   The campaign transforms compromised enterprise collaboration servers into malware-delivery infrastructure, putting not only TrueConf administrators at risk but also employees and contractors who join hosted meetings and download the client application. The attackers compromised TrueConf servers and replaced the legitimate Windows x64 client distribution file with a trojanized installer. Head Mare Exploits TrueConf Flaws When a conference participant visits the meeting guest page, they are prompted to download or update the TrueConf client. The modified package still installs the expected conferencing software, reducing suspicion, but also deploys PhantomCore onto the victim’s workstation, Guest page for joining a conference (Source: Kaspersky) The intrusion chain relies on two vulnerabilities tracked as KLCERT-26-057 and KLCERT-26-058. The first flaw allows an unauthenticated attacker to connect through TCP port 4307, which is open by default on TrueConf Server, and invoke an undocumented function to execute a malicious script. Kaspersky said the issue affects releases in the 5.3.X, 5.4.X, and 5.5.X branches before versions 5.3.9, 5.4.9, and 5.5.5, respectively.

5. update from bleepingcomputer.com

   CISA orders feds to patch actively exploited TrueConf Server flaws

   bleepingcomputer.com · 53d ago · August 21st, 2026

   federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. TrueConf Server is designed for secure corporate messaging and video conferencing and, unlike cloud-based software like Zoom or Microsoft Teams, it operates inside an organization's local network (LAN). The most severe is a critical missing authentication security flaw (tracked as CVE-2026-72529 ) that allows attackers without privileges to remotely execute arbitrary scripts on unpatched servers. The second is another critical severity vulnerability ( CVE-2026-72530 ) that unauthenticated threat actors can exploit through high-complexity code injection attacks to gain remote code execution. "Improper management of code generation can allow an attacker who has achieved code execution in the TrueConf Server isolated environment to escape the sandbox and execute arbitrary commands on the underlying operating system," TrueConf adds . On Thursday, CISA added the two flaws to its KEV catalog and ordered U.S. Federal Civilian Executive Branch (FCEB) agencies to secure their servers within two weeks, by September 3. "This type of vulnerability is a frequent attack