CISA gives agencies two weeks to patch video conferencing bug exploited by Chinese hackers

CISA and Check Point warn that CVE-2026-3502—a 7.8-severity flaw in TrueConf’s updater validation—has been actively exploited to push weaponized updates from compromised on-premises TrueConf servers to government endpoints in Southeast Asia; Check Point attributes the TrueChaos campaign to Chinese actors leveraging Havoc and ShadowPad, and CISA ordered federal agencies to patch within two weeks.