TrueConf Zero-Day Exploited in Attacks on Southeast Asian Government Networks

A zero-day vulnerability (CVE-2026-3502, CVSS 7.8) in TrueConf video conferencing software has been actively exploited in targeted attacks against government entities in Southeast Asia. The campaign, dubbed TrueChaos, leverages a lack of integrity check in the software's update mechanism to distribute tampered updates, potentially allowing attackers to compromise systems through a supply chain attack vector. Organizations using TrueConf should immediately assess their exposure and implement mitigations.

A high-severity security flaw in the TrueConf client video conferencing software has been exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia dubbed TrueChaos. The vulnerability in question is CVE-2026-3502 (CVSS score: 7.8), a lack of integrity check when fetching application update code, allowing an attacker to distribute a tampered update,

A zero-day vulnerability (CVE-2026-3502, CVSS 7.8) in TrueConf video conferencing software has been actively exploited in targeted attacks against government entities in Southeast Asia. The campaign, dubbed TrueChaos, leverages a lack of integrity check in the software's update mechanism to distribute tampered updates, potentially allowing attackers to compromise systems through a supply chain attack vector. Organizations using TrueConf should immediately assess their exposure and implement mitigations. A high-severity security flaw in the TrueConf client video conferencing software has been exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia dubbed TrueChaos. The vulnerability in question is CVE-2026-3502 (CVSS score: 7.8), a lack of integrity check when fetching application update code, allowing an attacker to distribute a tampered update, A high-severity security flaw in the TrueConf client video conferencing software has been exploited in the wild as a zero-day as part of a campaign targeting government entities in Southeast Asia dubbed TrueChaos. The vulnerability in question is CVE-2026-3502 (CVSS score: 7.8), a lack of integrity check when fetching application update code, allowing an attacker to distribute a tampered update,