InfoSecBulletin Cybersecurity for mankind
Zoom released a security update addressing six newly discovered vulnerabilities in its Workplace, Rooms, and SDK products for Windows, macOS, Linux, iOS, and Android. These issues could result in denial of service, information leaks, cross-site scripting, and integrity breaches.
CVE-2025-46788 (CVSS 7.4): Improper Certificate Validation in Zoom for Linux
CVE-2025-49464 (CVSS 6.5): Improper Authentication in Zoom Clients for macOS
CVE-2025-49463 (CVSS 6.5): iOS Clients Exposed via Control Flow Weakness
CVE-2025-49462 (CVSS 3.5): Cross-site Scripting Across Multiple Platforms
CVE-2025-46789 (CVSS 6.5): Another Buffer Overflow in Windows Clients
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
US banks faced unauthorized access by AI agents in customer accounts: Axios reports
Atlassian patched 176 flaw in Jira and Confluence: Fortinet Urges to Patch Flaws Affecting FortiOS, FortiManager
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
Zoom disclosed a second buffer overflow in Windows builds prior to 6.4.5, including VDI and Room components, which also results in denial of service. The flaw reinforces the importance of patching all instances, not just client endpoints.
Zoom emphasizes the importance of immediate patching:
“Users can help keep themselves secure by applying the latest updates available at https://zoom.us/download,” the advisory urges repeatedly.
For both IT admins managing cross-platform environments and remote users, keeping your Zoom client updated is crucial for protection against exploitation.
