All news with #tencent cloud tag

🛡️ A Palo Alto startup, Calif, developed a tool called WeWorm that exploits a remote code execution flaw in WeChat's VoIP stack to compromise Android and iOS devices via incoming calls. Researchers say the zero-click exploit required no user interaction and can hijack accounts to read/send messages and make calls. Tencent patched the vulnerability in Android 8.0.77 and iOS 8.0.76 after being notified, and Calif warns the worm could scale further when combined with other bugs.

📱 Researchers at security firm Calif created a worm that hijacks WeChat accounts via an incoming call and demonstrated it spreading across three test phones without user interaction. The attacker must already be one of the victim's WeChat contacts, and Calif says Tencent blocked the exploit on its servers after being notified in July. Calif withheld technical details pending a conference presentation and reported using AI to help locate the flaw and build the initial exploit.

🔍 Researchers disclosed two denial-of-service techniques, collectively dubbed CDN Tsunami, that exploit how major CDNs translate client-facing HTTP/3 into backend HTTP/1.1 requests, amplifying small attacker traffic to large origin load. The study tested Alibaba, Baidu, Cloudflare, CloudFront, Fastly, and Tencent, finding widespread susceptibility to a bandwidth amplification variant and partial susceptibility to a connection-amplification variant. Vendor mitigations are applied at CDN edges, and the work will be presented at a September 2026 symposium.

🔍 New analysis by Ontinue details VoidLink, a Linux-based command-and-control framework that generates implant binaries for credential theft, data exfiltration and stealthy persistence across cloud and enterprise hosts. The agent fingerprints AWS, GCP, Azure, Alibaba and Tencent environments and adapts its behavior, loading modular plugins for container escape and kernel-level stealth. Researchers identified unusual development artefacts — structured "Phase X:" labels, duplicated numbering, verbose debug logs and embedded documentation — that suggest parts of the implant were written or assisted by a large language model coding agent with limited human review.