CISA Adds Two Remotely Exploitable TrueConf Server Vulnerabilities to KEV Catalog
The US Cybersecurity and Infrastructure Security Agency (CISA) has added two remotely exploitable vulnerabilities in TrueConf Server to its Known Exploited Vulnerabilities (KEV) catalog, warning that both flaws are already being exploited in the wild.
TrueConf Server is a video conferencing and communication platform developed by TrueConf. On August 20, 2026, CISA included CVE-2026-72529 and CVE-2026-72530 in the KEV list after confirming active exploitation.
CVE-2026-72529 stems from missing authentication in a critical function, allowing unauthenticated remote attackers to execute arbitrary scripts. CVE-2026-72530 is a code injection vulnerability that permits attackers to break out of the isolated environment and execute arbitrary code on the host system.
Both vulnerabilities can be exploited remotely over TCP port 4307 without any authentication. Kaspersky rated the issues with CVSS v3.1 base scores of 9.8 and 9.0, classifying both as Critical.
Federal agencies are required to remediate CVE-2026-72529 by August 23, 2026, and CVE-2026-72530 by September 3, 2026. All organizations using the product are advised to apply available patches or mitigations immediately due to the confirmed in-the-wild exploitation.
Related articles
Vulnerability in Docker go-archive Library Allows File Creation and Overwrite Outside Target Directory
A vulnerability has been identified in the go-archive archive processing library used by Docker and related software. The flaw, tracked as CVE-2026-17106, affects the Unpack, UnpackLayer, and Untar functions and permits files to be created or overwritten outside the intended extraction directory. The issue stems from a mismatch between the path string validated by the code and the actual path resolved by the operating system. Docker rated the vulnerability 7.1 under CVSS v4.0 and classified it as High severity. A proof-of-concept exploit has already been published for macOS and Linux. The fix was implemented in go-archive 0.3.0 and shipped in Docker Engine 29.7.0, Docker CLI 29.7.0, and Docker Desktop 4.86.0.
Microsoft Defender Zero-Day ShieldBreak Enables SYSTEM Privilege Escalation, Bypassing July Rogue Planet Patch
Security researcher Nightmare Eclipse has publicly disclosed a new zero-day vulnerability named ShieldBreak in Microsoft Defender that allows any standard Windows account to escalate privileges directly to SYSTEM level. The flaw exploits a TOCTOU race condition in Defender's file scanning API callbacks, enabling attackers to swap file contents during the brief window when the scanner reads the file. Although linked to the earlier Rogue Planet vulnerability (CVE-2026-50656), the July patch did not fully address the attack surface, and an adjusted proof-of-concept continues to work on patched systems. Defender's high privileges and trusted status in enterprise environments amplify the risk, as compromised processes can execute malicious actions that appear legitimate in logs. Public disclosure without prior private reporting leaves a window of exposure until Microsoft issues an official fix. Blue teams are advised to enforce strict local permissions, monitor for anomalous Defender process behavior such as unusual child processes or repeated file handle operations, and implement layered defenses including application whitelisting and network segmentation.
Zombie Card Attack Revives Expired Visa Cards for Contactless NFC Payments
Researchers from the University of Massachusetts Amherst have demonstrated the Zombie Card attack, which enables contactless payments with certain expired Visa cards over NFC without breaking cryptography or cloning the card. The technique exploits inconsistencies in how payment terminals and issuing banks validate card expiration dates within the EMV protocol. By deploying two Android smartphones as a relay between the expired card and the terminal, the researchers intercepted the EMV field containing the expiration date and substituted a future date during the transaction. The terminal accepted the locally validated payment while the cryptographic data remained valid because Visa EMV Kernel 3 does not always bind the expiration field to the protected cryptogram. Testing showed varying bank responses: one issuer approved transactions of different amounts at multiple merchants, while another consistently declined them. The attack failed against Mastercard, American Express, and Discover due to stricter cross-checks or cryptographic protection of the expiration data. The method requires an active account and valid keys on the expired card, making it more complex than traditional skimming.
Critical Unauthenticated File Upload Flaw in Elementor Pro Allows Remote Code Execution on WordPress Sites
A critical vulnerability tracked as CVE-2026-32475 has been discovered in the Elementor Pro plugin for WordPress, enabling unauthenticated attackers to upload and execute arbitrary PHP code. The flaw resides in the file upload module where validation and saving processes handle empty filenames inconsistently across multipart requests. Attackers can bypass checks by sending one part with an empty filename and another containing a PHP backdoor, which gets stored in the publicly accessible wp-content/uploads/elementor/forms/ directory. Exploitation requires a published Elementor Pro form with the multiple-file upload option enabled, a setting that is disabled by default. The free version of Elementor remains unaffected, while the issue was resolved in Elementor Pro 4.2.2. Administrators are urged to update immediately and scan upload directories for unauthorized PHP files, as no active exploitation has been observed yet but public disclosure increases the risk.