The Patch Shipped in June. The Warning Came in August.

On June 18, a video conferencing company called TrueConf posted a short note on its product blog. "We have released an important security update for June 2026," it read. "We recommend immediately upgrading to the latest versions of TrueConf Server — 5.3.9, 5.4.9 and 5.5.5."

That was the whole warning. No CVE number. No severity score. No description of what was being fixed. One vague line about how declining the update would "reduce the protection of your video collaboration system against potential hacker attacks via the public Internet."

Two months later, on August 19, the flaws that update closed finally got their names: CVE-2026-72529 and CVE-2026-72530. The first carries a severity score of 9.8 out of 10, assigned by Kaspersky, which coordinated the disclosure. The next day, CISA added both to its Known Exploited Vulnerabilities catalog and gave federal civilian agencies until today, August 23, to fix the worse of the two.

Three days. The patch had been sitting on TrueConf's download page for sixty-six.

What Happened in Between

In July — after the fix existed, before the CVE did — Kaspersky detected an intrusion at an organization still running an unpatched TrueConf server.

Here is the plain-English version. TrueConf Server is on-premises video conferencing software. It runs inside a company's own network instead of a vendor's cloud, which is precisely why security-conscious organizations buy it. The product listens on TCP port 4307, which its own documentation says is open by default. An attacker who could reach that port needed no password at all. They called an undocumented function, ran a script, escaped the sandbox meant to contain it, and landed on the server with full SYSTEM privileges.

Then they did the part that matters. They replaced a file on the server with a web shell, dug into the TrueConf database, deleted entries from the event logs, and swapped the legitimate client installer for a poisoned copy.

From that moment, every employee who installed or updated the TrueConf client received a backdoor. Kaspersky named the two payloads PhantomCore and PhantomGraph. One of them used a Microsoft OneDrive account for command and control, which is not the sort of outbound traffic most companies flag.

The trojanized installers carried no valid digital signature. Nobody checked.

Kaspersky attributes the campaign to a group called Head Mare, which it previously tracked as hacktivists and now classifies as an APT — citing the sophistication of the tradecraft and the absence of the destructive encryption and wiping the group used to favor. The victims were Russian organizations across instrument manufacturing, electronics, transportation, energy, IT, and software development.

Twice This Year, by Two Unrelated Groups

Hold that shape in your head, because it happened before — five months earlier, to the same product.

On March 31, Check Point published research on a campaign it called TrueChaos: government networks in Southeast Asia, compromised through the TrueConf client's update mechanism. Different vulnerability, CVE-2026-3502, a missing integrity check when the client fetched update code. Different actor; Check Point attributed it with moderate confidence to a Chinese-nexus group. Same play.

Check Point's own summary: "By replacing a legitimate update with a malicious one, they turned the product's normal update flow into a malware distribution channel across multiple connected government networks."

Two unrelated nation-state-linked actors, one product, five months apart, both arriving at the same idea. That is not a coincidence. It is what happens when a trusted internal distribution point has more reach than the security team has visibility.

You Probably Don't Run TrueConf

Let me be direct about the limits of this story. TrueConf is a Russian company, the Head Mare victims were Russian organizations, and the odds that this particular product sits on your network are low.

That is not the point.

Kaspersky buried the sentence that should get your attention in the middle of a technical writeup: even if your organization does not use a TrueConf server, your employees may connect to a compromised one belonging to a business partner — and download the infected installer from there.

Substitute any vendor you like. The mechanism is generic. Somewhere in your environment sits a server that hands software to your employees' laptops and is trusted to do it — your endpoint management platform, your VPN client updater, your MDM. The question is not whether you run TrueConf. It is whether anyone at your company could tell you, this afternoon, which internal systems are permitted to push executable code onto employee machines, and whether any of them verify a signature before running it.

In my experience, the answer is that nobody knows. Not because the company is careless, but because that list has never been anyone's job to maintain.

The Clock Just Got Shorter

There is a regulatory dimension here that most boards have not caught up to.

On June 10, CISA issued Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk. It harmonizes two older directives and replaces "patch everything by severity score" with a four-factor test: whether the asset is publicly exposed, whether the flaw is known to be exploited, whether it can be exploited automatically, and whether exploitation hands an adversary total control. A vulnerability that trips all four gets three days — plus a mandatory forensic check on whether you were already compromised before you patched. Agencies have until December 7 to fully adopt it.

CISA scored CVE-2026-72529 as actively exploited, automatable, and total in its technical impact. Hence today's deadline.

The directive binds federal civilian agencies, not you. But the law firm Wiley, writing the day it was issued, flagged the gap that should worry every private-sector board. The framework, they noted, "does not address situations in which vulnerabilities are 'in the wild' before they've been incorporated into the Known Exploited Vulnerability (KEV) catalog."

That is exactly the window this attack lived in. Fix available June 18. Attack underway in July. CVE published August 19. KEV entry August 20. Any organization whose patching program keys off CVE severity scores had nothing to act on for two months, while the remedy sat on a public download page and attackers worked the gap.

Wiley called the three-day timeline "aggressive, bordering on unrealistic." They are right. That does not make it optional, and it does not make the underlying problem theirs instead of yours.

What to Ask Your CISO This Week

Which internal systems are authorized to push executable code — installers, updates, agents — onto employee laptops? Ask for the written list. Then ask whether each of those endpoints verifies a digital signature before executing what it receives, and what happens today when the signature is missing.

Second question: how do we learn about a vendor's security update when it arrives without a CVE? If the answer is that a ticket gets opened once a severity score shows up in a feed, you have just described a two-month blind spot in writing.

Third: for our ten most critical vendors, who reads their release notes, and how often?

None of that requires new budget. It requires someone to own the answer.