Security firm Calif has disclosed WeWorm, a zero-click worm that hijacks WeChat accounts via a regular voice call on both iOS and Android. The victim taps nothing — the account falls while the phone is still ringing, and the worm then calls that person's contacts to repeat the process.
No CVE identifier has been assigned. Calif describes the flaw as a memory corruption bug in WeChat's VoIP stack and is withholding technical details until a conference talk. Exploitation gives an attacker full control of the account — reading and sending messages, placing calls, acting as the victim — and, when chained with separate Android and iOS bugs, Calif says it reported elsewhere, results in full device compromise.
How WeWorm Spreads
Calif demonstrated the chain with three handsets: a Pixel 10a calling an iPhone 17e, then that compromised iPhone calling a second Pixel 10a. Each victim becomes the next attacker.
The one real precondition is that the caller must already be on the target's friend list, which Calif argues is a weak barrier — compromise one friend, pivot outward. WeChat, the company wrote, gives trusted contacts more privileges, "but once one contact is compromised, that trust works against you."
Answering is neither required nor protective; the victim hears silence while the exploit runs. Declining ends that attempt, but an attacker can simply retry later — while the target is asleep, for instance.
Has Tencent Patched It?
Yes. Calif reported the bug on 24 July, Tencent shipped WeChat Android 8.0.77 and iOS 8.0.76 on 21 August, and Calif confirmed server-side mitigation for all users on 28 August. On 4 September, Tencent confirmed the flaw allowed remote command execution.
The two accounts differ on one point. Calif credits client builds 8.0.77 and 8.0.76 with mitigating the bug; a Tencent spokeswoman told The New York Times no app updates were required and that the company had no reason to believe users were affected. Cyber Kendra has not independently verified either claim. Update WeChat regardless.
The Nine-Day Number
The timeline is the part defenders should read twice:
| Date (2026) | Event | Elapsed |
|---|---|---|
| July (unspecified) | Calif's AI discovers the bug | — |
| July 23 | Engineering team briefed | Day 0 |
| July 24 | Reported to Tencent | +1 |
| July 30 | First Android RCE exploit complete | +7 |
| August 2 | iOS RCE exploit complete | +10 |
| August 11 | Cross-platform worm demo complete | +19 |
| August 21 | Tencent ships 8.0.77 / 8.0.76 | +29 |
| August 28 | Server-side mitigation confirmed | +36 |
| September 8 | Public disclosure | +47 |
Bug to working RCE took about two days of human-plus-AI work; the worm took a further week. Calif CEO Thai Duong says his team still supplied the target selection and safe-testing judgment and had to babysit the process — this was not autonomous. But a capability that once required a funded team and months now fits within 9 working days.
Vinh Nguyen, a former NSA chief data scientist who reviewed the research, told the Times the worm could propagate exponentially and reach hundreds of millions of devices within hours. WeChat reports over 1.4 billion monthly active users.
Also Patch: cPanel CVE-2026-65643
Hosting administrators have their own patch to confirm. CVE-2026-65643, disclosed on 27 August, is a critical flaw in cPanel and WHM's domain parking and add-on domain functionality: any authenticated account that can add a parked or add-on domain can write arbitrary files anywhere on the server, leading to code execution as root. On shared hosting, a cheap account becomes a full server takeover.
Fixed builds are 11.110.0.141, 11.134.0.53, 11.136.0.37, 11.138.0.2, and WP Squared 11.138.1.7 or later. Servers on daily auto-updates already have it; others can run /scripts/upcp --force as root. cPanel published no CVSS score and no compromise-check guidance, and has not said whether the flaw has been exploited.
Frequently Asked Questions
Is there a CVE for WeWorm?
No. Calif has not published a CVE identifier for the WeChat flaw, and Tencent has not publicly assigned one. The bug is a memory corruption issue in WeChat's VoIP stack.
Do I need to update WeChat?
Update WeChat on Android to 8.0.77 or iOS to 8.0.76 or later. Tencent says the fix was applied server-side and no client update was required, but Calif's disclosure credits those builds. Updating costs nothing and removes the ambiguity.
Can WeWorm infect me if I don't answer the call?
Yes. The exploit runs while the phone rings and does not need the call to be answered. Declining stops that specific attempt, but the attacker can call again.
Who can attack me with this?
Only someone already on your WeChat friend list. That is a thinner defence than it sounds, since the worm's whole purpose is to compromise one contact and use that account to reach everyone else.
Was WeWorm used in real attacks?
There is no evidence it was. Calif built it as a research demonstration and reported it to Tencent before publishing. Tencent says it has no reason to believe any user was affected.
Did AI build the worm on its own?
No. Calif says AI did most of the work, but that human researchers chose the target, decided how to test it safely, and supervised the process throughout.