[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fJiIiP9X9AbQfH8dnvU-e5C7_bfVvl53zndVdNWTLoA0":3},{"article":4,"iocs":56,"watch_terms":72,"solutions":73,"lesson":165},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"b17460c4-c8e1-4485-acaa-03fcb95f0951","CISA orders feds to patch actively exploited TrueConf Server flaws","cisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws-7cc11d","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered U.S. federal agencies to prioritize patching two actively exploited vulnerabilities in the TrueConf Server self-hosted communications platform. [...]","CISA has mandated U.S. federal agencies to patch two critical vulnerabilities in TrueConf Server, a self-hosted communication platform. These flaws, CVE-2026-72529 and CVE-2026-72530, allow for remote code execution and script execution without authentication. The Head Mare hacktivist group has been exploiting these vulnerabilities since July 2026 to distribute backdoor malware through trojanized client installers.","CISA orders federal agencies to patch two actively exploited TrueConf Server flaws.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcisa-orders-feds-to-patch-actively-exploited-trueconf-server-flaws\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F01\u002F13\u002FCISA--headpic.jpg","2026-08-21T12:25:33+00:00","2026-08-21T14:00:18.219339+00:00",9,[17,20,23,26,29,31],{"name":18,"type":19},"TrueConf Server","product",{"name":21,"type":22},"TrueConf","vendor",{"name":24,"type":25},"Head Mare","threat_actor",{"name":27,"type":28},"Operation True Chaos","campaign",{"name":30,"type":19},"Zoom",{"name":32,"type":19},"Microsoft Teams","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,44,49,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":50},{"id":33,"icon":35,"name":36,"slug":37},{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,61,64,68],{"type":58,"value":59,"context":60},"cve","CVE-2026-72529","Critical missing authentication flaw allowing remote script execution.",{"type":58,"value":62,"context":63},"CVE-2026-72530","Critical flaw allowing unauthenticated remote code execution via code injection.",{"type":65,"value":66,"context":67},"mitre_attack","T1059","Exploitation of CVE-2026-72529 and CVE-2026-72530 allows arbitrary script\u002Fcommand execution.",{"type":69,"value":70,"context":71},"malware","backdoor malware","Deployed by Head Mare group via trojanized TrueConf client installers.",[21,18,30],{"controls":74,"vendors":158},[75,104,132],{"slug":76,"name":77,"problem":78,"products":79},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":105,"name":106,"problem":107,"products":108},"patch-management","Automated patch management","Known holes get closed in days, not months.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":105,"product_name":129,"url":130,"description":131},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":133,"name":134,"problem":135,"products":136},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[137,142,150],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":138,"product_name":139,"url":140,"description":141},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[159],{"slug":160,"name":161,"logo_path":162,"roles":163},"check-point","Check Point","\u002Fvendor-logos\u002Fcheck-point.png",[164],"reported_by",{"slug":166,"title":167,"body":168,"framework_refs":169,"framework_notes":181},"critical-trueconf-server-flaws-exploited-for-rce-without-authentication","Critical TrueConf Server Flaws Exploited for RCE Without Authentication","Two critical unauthenticated vulnerabilities in TrueConf Server (CVE-2026-72529 and CVE-2026-72530) are being actively exploited by the Head Mare hacktivist group to achieve remote code execution and deliver backdoor malware. The fact that no authentication is required to exploit these flaws dramatically lowers the barrier for attackers, putting any unpatched internet-facing instance at severe risk. Compounding the danger, threat actors leveraged trojanized client installers to distribute malware, introducing a supply chain dimension that can compromise end-user endpoints even after server-side patching. CISA's binding directive to federal agencies underscores the urgency — delayed patching of known, actively exploited vulnerabilities is one of the most preventable causes of breaches. Organizations running self-hosted communication platforms must treat patch cadence as a critical security control, not an optional maintenance task.",[170,171,172,173,174,175,176,177,178,179,180],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 12: Network Infrastructure Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST SP 800-53 SA-12: Supply Chain Risk Management","NIST SP 800-53 AC-3: Access Enforcement","NIST CSF ID.RA-1: Asset Vulnerabilities Identified","CISA KEV (Known Exploited Vulnerabilities) Catalog","ITIL Change Management: Emergency Change Procedures","GDPR Article 32: Security of Processing (for EU-applicable deployments)",{}]