ThreatWire Covers WeChat Zero-Click Worm, GitLab Exploitation, and DDROP

Summary

ThreatWire covers a reported zero-click worm spreading through WeChat calls, GitLab’s actively exploited CVE-2026-85706, exploited JFrog Artifactory flaws, and DDROP, a physical-access attack on cloud trusted execution environments.

Key points

Researchers at Kalif say a self-replicating worm spreads through WeChat calls and affects Android and iOS devices.
The report says the worm can take control of a WeChat account; chaining it with other reported bugs could lead to device control. The write-up identifies memory corruption in the WeChat VOIP stack but provides few technical details.
GitLab’s CVE-2026-85706 is described as a critical path traversal flaw allowing unauthenticated users to read arbitrary server files with one HTTP request. The transcript says Watch Tower Labs found it being exploited in the wild.
Wiz reportedly observed two actively exploited vulnerabilities in JFrog Artifactory; the transcript does not name their CVEs.
DDROP research describes a memory-protection attack against Intel and AMD systems used for cloud trusted execution environments. The presenter says it requires physical hardware access and an interposer.
Anthropic published a report describing threat actors using Claude to coordinate large-scale agentic operations.

Article Details

Topics: [00:39] Zero-click worm spreading through WeChat calls on Android and iOS
[01:37] GitLab vulnerability patches and CVE-2026-85706
[02:41] Reported in-the-wild exploitation of the GitLab vulnerability
[02:48] Apple Watch live rewind and recording-consent concerns
[03:12] Mullvad’s encrypted DNS service change and Quad9
[03:24] Anthropic report on threat actors using Claude
[03:45] Reported active exploitation of JFrog Artifactory vulnerabilities
[03:57] DDROP attack research targeting cloud trusted execution environments