InfoSecBulletin Cybersecurity for mankind
A critical security flaw in the TrueConf video call software has been used in real attacks. It is a zero-day threat in a campaign aimed at government organizations in Southeast Asia called TrueChaos.
The flaw is traced as CVE-2026-3502 . There is no check for integrity when getting application update code. This lets an attacker send a fake update that can run unwanted code. It has been fixed in the TrueConf Windows client from version 8.5.3, which came out earlier this month.
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
“The flaw stems from the abuse of TrueConf’s updater validation mechanism, allowing an attacker who controls the on-premises TrueConf server to distribute and execute arbitrary files across all connected endpoints,” Check Point said in a report.
The TrueChaos campaign has used this flaw in the update system to possibly send the open-source Havoc command-and-control (C2) tool to weak points. This action is believed, with moderate confidence, to be linked to a threat actor from China.
Attacks using the flaw were first reported by the cybersecurity firm Checkpoint at the start of 2026. Attacker took advantage of the trust users have in the update system to send a bad installer that uses DLL side-loading to start a DLL backdoor.
TrueConf Zero-Day
The DLL implant (“7z-x64.dll”) has also been observed performing hands-on-keyboard actions to conduct reconnaissance, set up persistence, and retrieve additional payloads (“iscsiexe.dll”) from an FTP server (“47.237.15[.]197”). The primary objective of “iscsiexe.dll” is to ensure the execution of a benign binary (“poweriso.exe”) that’s dropped to sideload the backdoor.
The exact malware used in the last stage of the attack is not known, but it’s believed with high confidence that the aim is to install the Havoc implant.
The report shows that TrueChaos is likely to be connected to a Chinese threat group based on their tactics. They use methods like DLL side-loading, Alibaba Cloud, and Tencent for their command and control network. Also, the same victim was attacked around the same time by ShadowPad, a complex backdoor often used by Chinese hackers.
The use of Havoc has also been linked to another Chinese group called Amaranth-Dragon. They are targeting government and law enforcement agencies in Southeast Asia in 2025.
“The exploitation of CVE-2026-3502 did not require the attacker to compromise each endpoint individually,” Check Point said. “Instead, the attacker abused the trusted relationship between a central on-premises TrueConf server and its clients.
By replacing a legitimate update with a malicious one, they turned the product’s normal update flow into a malware distribution channel across multiple connected government networks.”
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) put CVE-2026-3502 on its list of known security issues. They require federal agencies to fix it by April 16, 2026.
