TrueConf patched in silence, and the silence didn't hold

On June 18, TrueConf's blog asked customers to update their video conferencing servers to versions 5.3.9, 5.4.9, or 5.5.5. It named no CVE, described no vulnerability, and offered one sentence of motivation:

Declining to install the updates will reduce the protection of your video collaboration system against potential hacker attacks via the public Internet.

TrueConf blog, June 18, 2026

The silence lasted less than two months. On August 11, Kaspersky published research attributing active exploitation of two TrueConf Server flaws to the group Head Mare. NVD records for both went live on August 19, and on August 20 CISA added them to the Known Exploited Vulnerabilities catalog, "based on evidence of active exploitation."

What the flaws are

Both sit on the same door. Per NVD, CVE-2026-72529 (CVSS 3.1: 9.8) lets "a remote unauthorized attacker with network access via port 4307/TCP" to an affected server "execute an arbitrary script by calling an undocumented function." CVE-2026-72530 (CVSS 3.1: 9.0) is the second stage: a specially crafted script can "break out of the isolated environment and execute arbitrary code on the host system." Chained, per Kaspersky's write-up, they take an unauthenticated attacker from the network to code execution as NT AUTHORITY\SYSTEM. No credentials at any step.

What the campaign did with them

Kaspersky classifies Head Mare, previously labeled hacktivists, as "an APT group due to the sophistication of their TTPs and the absence of destructive activity," and describes campaigns against "Russian organizations across various industries: instrument manufacturing, electronics, transportation, energy, IT, and software development."

The use they made of a compromised server is the memorable part: "replacing the original TrueConf Client distribution with an infected version containing the PhantomCore backdoor." The server's own client-download feature became the delivery vehicle, handing a backdoored installer to meeting participants. The follow-on PhantomGraph backdoor split its work across two DLLs and used "an account on Microsoft OneDrive cloud storage as their command-and-control (C2) server," which means its traffic looks like traffic to Microsoft.

Remediation, and one version string to distrust

The fix is the June update, plus verification that client distributions "have a valid TrueConf digital signature and have not been tampered with." Because the exposure is a single TCP port, a server whose port 4307 is not reachable from the internet has a much smaller problem; TrueConf's own June language singles out "attacks via the public Internet."

One wording deserves suspicion. NVD's affected range reads "versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, and earlier," which taken literally includes the very builds Kaspersky says were "patched by the vendor in the latest TrueConf Server updates (versions 5.3.9, 5.4.9, and 5.5.5)." When the databases collide at a boundary, do not run the boundary: run the newest available release.

And patching is not the whole job. CISA's alert leans on Binding Operational Directive 26-04, which "establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied." That check matters here more than usual. The patch shipped in June with no urgency signal attached; the exploitation was already running. A server updated in July can still be a server that shipped backdoored installers in June, and only the compromise assessment, not the version string, tells you which one you have.

Primary sources: CISA KEV alert, 2026-08-20, NVD CVE-2026-72529, NVD CVE-2026-72530, Kaspersky Securelist: Head Mare targets TrueConf Server, TrueConf security updates blog, read 2026-09-01.