TrueConf Zero-Day Exploited in Asian Government Attacks

SecurityWeek coverage highlights multiple active, high-impact incidents and vulnerabilities. A zero-day in the TrueConf video conferencing platform is being exploited by a Chinese threat actor against Asian government targets for reconnaissance, privilege escalation, and payload execution. Critical ShareFile flaws can be chained to bypass authentication and achieve unauthenticated RCE/upload of arbitrary files; React2Shell has been used in a large-scale credential-harvesting campaign (750+ systems). Additional notable items include a $285M drain from Drift attributed to North Korean attackers,