Tencent WeChat security update for zero-click call flaw
Security Patch Release
Summary
Hide ▲
Show ▼
Tencent released WeChat 8.0.77 for Android and 8.0.76 for iOS to mitigate a zero-click account-takeover flaw affecting mobile users. Calif said the releases mitigated the bug, and Tencent later blocked the exploit on its servers for all users. No attacks using the flaw were reported.
Related Happenings
Apple macOS security update for CVE-2026-65400
Security Patch Release
H score89
First: 14.08.2026 17:59
Last: 14.08.2026 17:59
Sources 1
About this happening:
Apple released fixes for CVE-2026-65400 in macOS Tahoe 26.6.1 and related releases, closing a Screen Sharing authentication bypass that could let network attackers...
Apple macOS security update for CVE-2026-65400
Security Patch ReleaseAbout this happening: Apple released fixes for CVE-2026-65400 in macOS Tahoe 26.6.1 and related releases, closing a Screen Sharing authentication bypass that could let network attackers...
Timeline
-
08.09.2026 14:54 1 articles · 21h ago
Calif knew of a WeChat incoming-call flaw
Technical Analysis UpdateCalif's engineering team knew of a WeChat incoming-call flaw on 23 July.
Show sources
- WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls — thehackernews.com — 08.09.2026 14:54
-
08.09.2026 14:54 1 articles · 21h ago
Calif finishes the first Android exploit for WeChat
Technical Analysis UpdateOn 30 July, Calif finished the first Android exploit for the WeChat account-takeover bug.
Show sources
- WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls — thehackernews.com — 08.09.2026 14:54
-
08.09.2026 14:54 1 articles · 21h ago
Calif demos a WeChat worm across three test phones
Technical Analysis UpdateOn 11 August, Calif demonstrated a WeChat worm across three test phones: one Android phone called an iPhone, took over its WeChat while the phone was still ringing, and the compromised iPhone then called a second Android phone.
Show sources
- WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls — thehackernews.com — 08.09.2026 14:54
-
08.09.2026 14:54 2 articles · 21h ago
Tencent releases WeChat 8.0.77 for Android and 8.0.76 for iOS
Mitigation Patch UpdateTencent released WeChat 8.0.77 for Android and 8.0.76 for iOS on 21 August, and Calif said those releases mitigated the bug.
Show sources
- WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls — thehackernews.com — 08.09.2026 14:54
- WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls — thehackernews.com — 08.09.2026 14:54
-
08.09.2026 14:54 1 articles · 21h ago
Tencent blocks the WeChat exploit on its servers
Mitigation Patch UpdateOn 28 August, Calif confirmed that Tencent had blocked the WeChat exploit on its servers for all users, so the server-side mitigation no longer required any user action.
Show sources
- WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls — thehackernews.com — 08.09.2026 14:54
-
08.09.2026 14:54 1 articles · 21h ago
Checks find no CVE or Tencent advisory for the WeChat flaw
Technical Analysis UpdateOn 8 September, checks found no CVE identifier for the WeChat flaw and no advisory on Tencent's security response site, and the App Store listing still showed 8.0.76 as the current version.
Show sources
- WeChat Zero-Click Worm Took Over Accounts on iPhone and Android via Incoming Calls — thehackernews.com — 08.09.2026 14:54