Zoom

Critical Zoom Vulnerability Exposes All Platforms to Remote Takeover via Screen Sharing Annotations

A high-severity vulnerability in Zoom Workplace clients across Windows, Mac, iOS, Android, and Linux allows attackers to remotely seize full device control simply by having a victim enable screen sharing and the annotation tool. The flaw requires no user interaction such as clicking links or dismissing warnings, and the compromise occurs silently without visible alerts. Security researchers demonstrated that AI tools enabled complete exploit development within 24 hours, dramatically lowering the barrier for advanced attacks previously limited to nation-state actors. The issue affects hundreds of millions of remote workers who rely on Zoom’s daily screen-sharing features. Official patches have been released, and users are urged to update immediately while avoiding annotation tools in sensitive sessions. Apple simultaneously addressed related macOS flaws in multiple versions. The incident highlights how generative AI is accelerating the weaponization of vulnerabilities.

Top Cybersecurity Stories of the Week: WordPress XSS Flaw, Microsoft Patch Tuesday, Cisco Zero-Day and More

Security NEXT has published its weekly ranking of the most viewed articles between August 9 and August 15 2026. The list is dominated by critical vulnerabilities affecting widely deployed platforms including WordPress, Microsoft products, Cisco networking gear and Fortinet FortiOS. A cross-site scripting issue in the WordPress login screen and a remote code execution flaw in WordPress 7.0.4 both received immediate patches. Microsoft released updates addressing more than 400 vulnerabilities, while Cisco disclosed a zero-day denial-of-service flaw in its SSL VPN implementation. Additional high-impact issues were reported in FortiOS, Google Chrome, Zoom and Jenkins, prompting urgent remediation guidance from vendors.

AI Uncovers Zoom Vulnerabilities Allowing Silent Device Takeover via Screen Sharing Annotations

Researchers at A Security identified multiple vulnerabilities in Zoom that enabled attackers to compromise participant devices during video calls without any user interaction. The flaws resided in the shared annotations protocol used for drawing and marking on shared screens. Victims only needed to join a meeting where screen sharing was active, affecting both regular participants and meeting organizers. The discovery was notable because it relied on publicly available AI models, requiring fewer than 20 prompts to locate the issues and build a working exploit prototype. The vulnerabilities impacted Zoom clients across Windows, macOS, Linux, iOS, and Android. Zoom addressed the problems through security bulletin ZSB-26015 with server-side and client patches. The research highlights how AI can dramatically accelerate vulnerability discovery compared to traditional manual analysis.

Weekly Roundup Highlights Critical Vulnerabilities in Zoom, nginx, SonicWall, and Microsoft Products

Security NEXT published its weekly ranking of the most-read articles for the period of July 12 to July 18, 2026. The top story covered a serious vulnerability in the Windows version of Zoom that has already been fixed in the latest release. Other high-ranking items included a cyber attack that disrupted operations at Nichirei and affected frozen food shipments, as well as Microsoft’s monthly security update addressing more than 500 vulnerabilities including zero-days. Additional widely read reports detailed multiple flaws in nginx, a zero-day issue affecting SonicWall SMA1000 series appliances, and a data exposure investigation involving a TV Asahi subsidiary. The list also featured advisories on GNU Wget SSRF flaws, privilege escalation bugs in Microsoft Defender, and 15 security fixes for Chrome including two rated critical.