InfoSecBulletin Cybersecurity for mankind
A new set of flaws in Zoom’s software can let hackers take control of systems. Zoom has launched security updates to fix three different flaws in its Windows and iOS apps.
The most serious of these flaws lets authorized attackers gain higher system powers, changing a regular user account into a major administrative risk.
Rapid7 Unveils 17 Zimbra Collaboration Suite Flaws Breaking Identity Boundaries
CISA launched two free tools Identify Security Misconfig in Microsoft 365 and Google Workspace
Apple iOS 27.2 Released Fixes 163 Flaws, Including Critical WebKit RCE
CISA adds PHP2Shell to KEV, PHP Releases New Security Updates to Fix Critical HTTP2Shell flaw
Cloudflare Unveils Emergency WAF Ruleset Update on Brotli flaw
Daily Cyber security update for 26.10. 2026
The Washington Post report
Ex-DOGE AI startup Cathedral Breaches Anthropic Internal Systems within 12 Hours
Daily Cyber security update for 25. 10. 2026
Daily Cyber security update for 24. 10. 2026
PHP shares new RCE flaw (CVE 2026-115560) with no patch but mitigation
Zoom Rooms and Workplace Flaws
The first issue affects Zoom Rooms for Windows. Known as CVE-2026-30906, this serious flaw has a CVSS score of 7.8 out of 10. The flaw comes from a weak point in the software’s installer. If someone already has normal access to a computer, they can use this flaw to gain higher access.
Hackers often use this access to disable security tools, steal important company data, or install ransomware. This weakness affects all versions of Zoom Rooms for Windows before 7.0.0.
Security researcher “sim0nsecurity” discovered a second high-severity bug in the Zoom Workplace VDI Plugin for Windows.
This flaw is dubbed CVE-2026-30905 and has a CVSS score of 7.8. It happens because a file name or path is controlled externally in the software’s Windows Universal Installer.
This Zoom Rooms bug allows a local user with permission to start a privilege escalation attack. It affects the Zoom Workplace VDI Plugin version 6.6.10 and needs a quick update to version 6.6.11 or later.
While Windows systems have the highest risks, mobile users are also impacted by these updates. Zoom Workplace on iOS has a less serious problem known as CVE-2026-30904.
This issue involves a failure of a protection mechanism that could lead to unauthorized information disclosure.
With a CVSS score of 1.8, the risk is low right now because the attacker needs to physically access the target’s iOS device.
However, it still represents a frustrating privacy breach for affected users. Security researcher “errorsec_” reported this flaw, which affects all iOS app versions older than 7.0.0.
Zoom strongly encourages all users, IT admins, and remote workers to install the latest security updates right away. Users can protect their devices by getting the newest, updated software from the official Zoom download center.
