CISA Urges Immediate Patching of Exploited TrueConf Vulnerabilities

CISA has warned federal agencies about two critical vulnerabilities in TrueConf, a secure video conferencing platform. The vulnerabilities, CVE-2026-72529 and CVE-2026-72530, allow attackers to execute arbitrary code remotely. Exploitations can lead to attacks like the deployment of PhantomCore malware by the hacktivist group Head Mare, which has been using these vulnerabilities to compromise systems and gain access to sensitive information. Organizations using TrueConf are urged to update to patched versions and check for signs of intrusions.