Severity Daily

IT and AI security incidents, checked against the primary source

Tag: Tencent

  • In all nine of today’s stories the patch already existed — what arrived today was the record

    In all nine of today’s stories the patch already existed — what arrived today was the record

    Four vulnerabilities entered CISA’s Known Exploited Vulnerabilities catalog today, and three of them come due Saturday, September 12. The one to deal with first is Cisco’s. CVE-2026-20079 is a 10.0 authentication bypass in Secure Firewall Management Center, and Cisco revised a six-month-old advisory on the same day to say active exploitation has been observed. Advisory revision, exploitation confirmation, KEV listing, and a three-day federal clock all landed together, on the box that administers the firewalls.

    It is not the day’s biggest number. That belongs to Mathspace, which says 1,079,819 people were exposed after attackers reached its self-hosted Metabase. But that breach is over: the intrusion ran from August 10, the data left on August 27, the patch went on August 29, and individual notifications began September 6. There is nothing in it for a defender to do tonight. The Cisco deadline is in three days, and the appliance is reachable from the network.

    The thread today is not the KEV batch, and it is the more uncomfortable one. In all nine of today’s stories, a fix already existed before the thing that finally made anyone look. Open WebUI’s 0.11.1 shipped 15 days before the 16 CVEs it closes were published inside a single hour, and its release notes say plainly that some security fixes were being withheld. AWS’s 1.1.7 reached PyPI 76 days before the bulletin disclosing the 9.6 it fixes, and 71 days before a separate bulletin credited that same release with a 6.5. Tencent patched a wormable zero-click WeChat flaw on August 21, and it still has no CVE and no advisory. Metabase’s advisory was August 6. The F5 BIG-IP rootkit Sophos took apart runs on a flaw whose federal remediation deadline passed on March 30, 2026, and Shadowserver still counts 795 vulnerable hosts. The gap this publication keeps finding is not between the flaw and the fix. It is between the fix and the record that would tell an administrator the upgrade was worth taking a window for.

    After Cisco, the other two Saturday deadlines. The 9.3 NetScaler authentication bypass is harder to act on than to read about: the CVE record carries no description at all, only a mangled version range, and Citrix’s advisory, unchanged since August 19, lists its mitigations as “None.” The 2025 FortiOS heap overflow scores 9.8 in the record and 8.1 from Fortinet, and CISA names FortiSASE among the affected products while the record does not; FortiOS 6.4 has no fixed build in either source. The exploited Chrome V8 zero-day runs to September 23, which is time you will want, because Google rates it Medium and the release note CISA links to still says its security section is coming.

    The two evening records are patch-soon work behind all of that: the AWS Postgres MCP server, where AWS’s advisory and AWS’s own patch comment disagree about which mode was exposed, and Open WebUI, where the 8.1 OAuth bypass only bites SQLite deployments — which is the default one.

    What is still open. Fortinet’s own advisory could not be read at all from here, so its affected list, fixed builds, and any exploitation language are missing from our story rather than absent from the world. Citrix has said nothing about exploitation three weeks after publishing. Google’s release note has now been blank for two days on a flaw CISA lists as exploited. And the WeChat flaw, patched on August 21, remains invisible to every scanner in every fleet, because there is no identifier to scan for.

    Sourcing note: this recap introduces no facts beyond the nine stories it links, each of which carries its own sourcing note. The KEV dates above are carried from those pages, which verified them against CISA’s own cisagov/kev-data mirror on GitHub, since cisa.gov returns 403 to automated retrieval. A re-read of that mirror during this run returned an older catalog version and truncated content, and the NVD records for CVE-2026-20079 and CVE-2026-87491 do not yet carry cisaExploitAdd or cisaActionDue — NVD lags the catalog by hours.

  • Tencent patched a wormable zero-click WeChat flaw on August 21, and it still has no CVE

    Tencent patched a wormable zero-click WeChat flaw on August 21, and it still has no CVE

    Calif published a working zero-click WeChat worm on September 8. The bug it exploits was patched on August 21, has no CVE, and appears in no Tencent advisory, which means no scanner, no software bill of materials, and no mobile device management policy can see it.

    What happened

    On Monday, September 8, 2026, the security firm Calif published research it calls WeWorm: a memory corruption flaw in WeChat’s VoIP stack that yields zero-click remote code execution on both iOS and Android, chained into a worm that spreads from one WeChat account to the next over calls.

    Calif’s description of the behavior is short and specific. “Simply by calling a victim, WeWorm can hijack their account and call their friends, spreading from phone to phone.” The victim does not need to answer. Calif states that declining a call stops only that particular attempt, not a later one. Once the account is compromised, the demonstrated capability is to “read and send messages, make calls, and act on the victim’s behalf” — and the victim’s contact list is the propagation path.

    The disclosure timeline Calif publishes runs like this. The bug was found in July 2026, and the team became aware of it on July 23. It was reported to Tencent on July 24. Working exploits for Android and iOS were finished on July 30 and August 2. A polished worm demo was completed on August 11. Tencent shipped patched builds on August 21, 2026 — Android 8.0.77 and iOS 8.0.76. On August 28, Tencent confirmed a server-side mitigation. On September 4, per Calif’s timeline, “Tencent confirmed that the vulnerability could be exploited for remote command execution.” Calif published on September 8.

    Calif is withholding the technical detail, saying it is pending further industry-wide work on attack surface reduction in messaging platforms. What it published is demonstration video, not exploit code. The firm’s stated mission, in its own words, is “to keep the Internet together by occasionally taking it apart.”

    Calif also makes a claim about how the work was done: “Working with AI, our team found the bug and wrote the first remote code execution (RCE) exploit in about two days. Building the worm took one more week.” That is a single-vendor claim about its own process, with no tooling named and nothing reproducible attached. Treat it as an assertion, not a measurement.

    The part that is checkable, and that we checked, is the record. A query of the National Vulnerability Database for CVE records mentioning WeChat and published between August 1 and September 9, 2026 returns three: an SSRF flaw in a WordPress plugin that scrapes WeChat articles (CVE-2026-32467), unauthenticated access to WeChat bot endpoints in FastGPT (CVE-2026-68929), and SQL injection in a SeaCMS WeChat module (CVE-2026-85138). A wider query run during our earlier check, covering June 1 forward, added four more records in the same shape — third-party integrations, plugins, and account-binding endpoints. None of them is a memory corruption flaw, a VoIP flaw, or remote code execution in the WeChat client itself.

    There is no CVE for WeWorm. There is also no Tencent security advisory for builds 8.0.76 and 8.0.77 that we could find, and the iOS release notes for 8.0.76 describe the update in the ordinary language of bug fixes. Tencent’s confirmations on August 28 and September 4 are reported by Calif; Tencent has not published them.

    Why it matters

    Start with what did not happen, because it governs how alarmed anyone should be today. Nobody has reported exploitation of this flaw by anyone other than Calif. There is no named victim. The patch has been available since August 21. Tencent says a server-side mitigation covers all users, though that is a claim relayed through the researchers and it cannot be verified from a handset. Individual risk right now is low, and the piece of this that should worry an administrator is not the bug.

    It is the hole where the bug’s identifier should be. Essentially every mechanism an organization uses to manage vulnerability at scale is keyed to a CVE identifier. The scanner matches on it. The software bill of materials is checked against it. The mobile device management policy that forces an update on a fleet is written against a severity attached to it. The weekly report to a security lead is a list of them, and an auditor asking whether a specific flaw was remediated asks by identifier. A vulnerability with no CVE does not exist to any of that machinery. It is not that the tooling scores it low; the tooling never sees it.

    The practical consequence is that the only handle anyone has on WeWorm is a version number, and version numbers rot out of institutional memory in about a week. WeChat sits on a very large number of corporate phones — Tencent reports combined WeChat and Weixin monthly active users above 1.4 billion — and a great many of those are in bring-your-own-device fleets where the security team’s visibility begins and ends at what the MDM console reports. “Is anyone still below 8.0.76?” is a question somebody has to think to ask, this month, before the number is forgotten. “Are we clear on CVE-2026-XXXXX?” would have asked itself, forever, on a schedule.

    There is a second-order cost. A build whose release notes describe bug fixes, and which in fact closes a wormable zero-click remote code execution flaw, teaches the people who manage phones that WeChat updates are routine. That lesson does not stay attached to this update. It gets applied to the next one, and to the one after that, and it is applied by exactly the administrators with the least other information to go on.

    This site covered a related case on September 5, when MikroTik withheld a RouterOS advisory to buy patching time and working exploits appeared the next day. That is the defensible version of the same instinct: hold detail while defenders catch up. The distinction is that a withholding window closes. Calif published on September 8. The reason to keep the record thin expired that day, and the record is still empty. Whether that reflects a decision or simply the absence of a CNA willing to take the report is not something we can determine from outside, and it matters less than the effect, which is the same either way.

    On the AI claim, one note. Calif says AI found the bug and wrote the first exploit in about two days. That is unverified. The general direction is independently evidenced from another quarter — OpenAI said on September 3 that GPT-6 Astra is the first of its models to reach the Critical cybersecurity tier under its Preparedness Framework, describing it as able to find previously unknown security flaws and develop new ways to exploit them without step-by-step human guidance. Those are two different kinds of claim, from two parties with different interests, and neither confirms the other. What can be said is that if the time from a fresh look at an attack surface to a working worm is genuinely measured in days, then a patch window of a few weeks and a record that never gets an identifier are a poor combination.

    What to do

    Update WeChat to iOS 8.0.76 or Android 8.0.77 or later. That is the whole fix on the client side.

    Check by app version, not by identifier. Pull WeChat version numbers from your MDM inventory and look for anything below those builds. Do not wait for a scanner finding, because there is nothing for a scanner to find. If your fleet policy is driven by CVE severity thresholds, this flaw will not trip it, and a manual version floor is the only control that will.

    For higher-risk users — executives, anyone in a role where account takeover is worth an attacker’s effort, anyone whose contact list is itself sensitive — the demonstrated outcome is full account compromise and onward spread to contacts. Confirm those devices individually rather than trusting a fleet-wide compliance percentage.

    Do not rely on the server-side mitigation as a reason to skip the update. It is a vendor claim relayed by a third party, it cannot be checked from the device, and it is not a substitute for a patched client.

    Sourcing note

    Checked: Calif’s WeWorm research page, published September 8, 2026, read directly for the vulnerability description, the disclosure timeline, the patched build numbers, and all quoted language. The NVD API, queried by us for CVE records mentioning WeChat published August 1 through September 9, 2026, and in an earlier check for June 1 forward; the query returns no memory corruption, VoIP, or client-side RCE record. The Register’s September 9, 2026 report, which states that Tencent confirmed the researchers’ findings but carries no direct Tencent quote and no CVE. Help Net Security and Security Boulevard, both September 8, 2026, used as leads only.

    Could not reach: any Tencent security advisory for WeChat 8.0.76 or 8.0.77, because none appears to have been published. CISA’s own pages return 403 to automated fetching and were not consulted for this story, which does not involve a federal deadline.

    Unresolved: whether a CVE will be assigned, and by which CNA — there may be no CNA of record for the WeChat client, which would explain the gap without any decision to withhold. Whether the server-side mitigation closes the path for clients that are still unpatched. Whether anyone other than Calif ever exploited this. Calif’s two-day figure for AI-assisted discovery and exploitation, which is a claim about its own work and is not independently verifiable.