CISA orders feds to patch actively exploited TrueConf Server flaws

Two critical unauthenticated vulnerabilities in TrueConf Server (CVE-2026-72529 and CVE-2026-72530) are being actively exploited by the Head Mare hacktivist group to achieve remote code execution and deliver backdoor malware. The fact that no authentication is required to exploit these flaws dramatically lowers the barrier for attackers, putting any unpatched internet-facing instance at severe risk. Compounding the danger, threat actors leveraged trojanized client installers to distribute malware, introducing a supply chain dimension that can compromise end-user endpoints even after server-side patching. CISA's binding directive to federal agencies underscores the urgency — delayed patching of known, actively exploited vulnerabilities is one of the most preventable causes of breaches. Organizations running self-hosted communication platforms must treat patch cadence as a critical security control, not an optional maintenance task.