TrueConf Zero-Day Exploited in Attacks on Southeast Asian Government Networks

A severe vulnerability in TrueConf's video conferencing software, tracked as CVE-2026-3502, has been exploited by attackers targeting government networks in Southeast Asia. This high-severity flaw, with a CVSS score of 7.8, allows malicious actors to distribute tampered updates due to a lack of integrity checks when fetching application update code. The campaign, dubbed TrueChaos, has been actively exploiting this zero-day vulnerability, expanding the attack surface for vulnerable entities. The vulnerability's exploitation enables attackers to compromise TrueConf clients, potentially leading to further malicious activities. As a result, organizations using TrueConf's video conferencing software should prioritize patching this vulnerability based on their exposure and existing exploitation evidence¹. This vulnerability's exploitation matters to security practitioners as it highlights the need for prompt patch management and vulnerability assessment to prevent similar attacks on their networks.