It seems that CVE-centric processes are failing again... June 18, 2026: TrueConf LLC publishes a security update (source: https://trueconf.com/blog/update/trueconf-server-security-updates-june-2026). June 18, 2026 – August 11, 2026: TrueConf LLC urges its customers to update ASAP at least five times (by e-mail). No details given, but five e-mails are unusual for a routine update. August 11, 2026: Kaspersky posts an article about detected (in-the-wild) exploitation of two vulnerabilities already fixed in June (https://securelist.com/tr/head-mare-targets-trueconf-server-with-phantomcore/120988/). No CVE IDs listed. The article says that the exploitation was detected in July! August 19, 2026: two CVE IDs got assigned by Kaspersky CNA (CVE-2026-72529 and CVE-2026-72530). August 20, 2026: these CVE IDs are added to the CISA KEV Catalog. CVE-2026-72529 has a tight due date: 2026-08-23.