TrueConf zero-day turned trusted updates into a government espionage backdoor
by Artem Safonov
A zero-day in TrueConf's update mechanism let a China-linked actor distribute Havoc C2 implants to dozens of Southeast Asian government agencies through a single compromised server. CVE-2026-3502 (CVSS 7.8) required no signature bypass because there was no signature check. Patched …
Read more →
