Picture a routine video call. A dozen people on the grid, someone sharing their screen, the usual meeting. Now imagine that one of those attendees — a name you didn’t recognize but assumed a colleague had invited — could, without clicking anything, without sending you a file, without you touching a single button, quietly take complete control of your computer. Turn on your camera. Read your files. Install malware. And do it to every other person on the call, one by one, with no sign on anyone’s screen that anything was wrong.

That was the real, demonstrated capability of a set of flaws that security researchers recently disclosed in Zoom — a platform used by a huge share of the business world, including most of the Fortune 100. Zoom has released fixes. But this story is worth understanding in full, not just as “update your Zoom” (though please, do that right now), because the way these flaws were found points to a shift that affects every business and every piece of software you run. Let’s break down what the flaw was, the one detail that made it so dangerous, the fascinating and slightly unsettling story of how it was discovered, and what you should actually do.

The flaw: hiding in the “draw on screen” button

The vulnerabilities lived in Zoom’s annotation feature — the handy tool that lets people draw, highlight, and add text on a shared screen during a meeting. It’s a feature countless teams use every day without a second thought. Underneath it, though, is a bit of machinery that turned out to be dangerous.

When you scribble an annotation, your Zoom turns that drawing into a compact message and sends it to everyone else’s Zoom, which unpacks the message and redraws your scribble on their screens. That’s normal and necessary — it’s how the feature works. The problem the researchers found is that Zoom’s software, on the receiving end, didn’t carefully check those incoming messages before acting on them. A specially crafted, malicious annotation message — one that isn’t really a drawing at all — could corrupt the receiving program’s memory and trick it into running the attacker’s code.

Here’s the part that elevates it from “a bug” to “an emergency.” The researchers noted that every Zoom client automatically processes whatever it receives, and that the feature opens a direct channel between meeting participants — meaning an attacker in the meeting could aim at each person individually. The victim doesn’t have to accept anything, click anything, or even be actively looking at the screen. Simply being present in the meeting, with a vulnerable version of Zoom, was enough. That’s what security people call a “zero-click” attack, and it’s about the most dangerous kind there is, because there’s no mistake for the victim to avoid making. You can’t train someone not to click when there’s no click.

Why this one is genuinely scary: most attacks we write about need the victim to do something — click a link, open a file, enter a password on a fake page. Your best defense is usually an alert, skeptical human. This flaw removed the human from the equation entirely. If you were in the meeting on a vulnerable version, there was no warning sign, no prompt to decline, and no visible clue that your machine had been taken over. When an attack requires nothing from the victim, the only defense left is having already installed the fix. That’s the whole lesson in one line.

In fairness, one clarification on severity. The researchers describe the attack as fully zero-click, requiring nothing from the victim. Zoom’s own security bulletins, by contrast, list these flaws as requiring some user interaction and rate them high-severity rather than the very top of the scale. This kind of gap between a researcher’s description and a vendor’s advisory is common, and reasonable people can read the details differently. We’d simply note that the safe course doesn’t depend on resolving that debate: whether the attack needs a trivial interaction or none at all, the fix is identical, and the smart move is to treat it as serious.

The twist: an AI found it in under a day

Here’s the part of this story that we’d argue matters even more than the flaw itself, and it’s the part the headlines about “update Zoom” tend to skip. According to the researchers who found it, this was not the product of an elite team laboring for months. They reported building a working exploit for this chain of flaws in less than 24 hours, using fewer than 20 prompts to publicly available AI models.

Sit with that for a moment, because the researchers themselves framed it as the real headline. In their words, producing a working exploit against this kind of proprietary, undocumented system has historically been “nation-state work” — the domain of elite government teams, months of effort, and budgets that governments regulate like weapons. Their point in publishing was not merely “Zoom had a bug.” It was that the barrier to finding and weaponizing this kind of deep flaw has, thanks to AI, dropped through the floor.

Regular readers will recognize this theme, because it keeps arriving from every direction. It’s the same shift we saw when a researcher altered supposedly tamper-proof DNA evidence files in 45 minutes with AI help, and when an experimental AI agent chained together a real intrusion on its own. The pattern is unmistakable and worth stating plainly:

The through-line of security in this era: attacks that used to require rare expertise, huge budgets, and months of work are becoming fast, cheap, and available to far more people. The flaws were always there. What’s changed is that the effort required to find and exploit them is collapsing. For a business, the practical consequence is uncomfortable but clarifying: you can no longer count on “that’s too hard for anyone to bother with” as a form of protection. The things that were protected only by difficulty are becoming exposed — which makes the boring fundamentals, like keeping everything updated, more important than they have ever been.

There’s a genuinely reassuring flip side, though, and it’s important. This same capability was in the hands of responsible researchers, who did exactly the right thing: they reported the flaws privately to Zoom and coordinated the announcement so that a fix and a behind-the-scenes protection were in place before the details went public. That’s the system working as intended. The knowledge that these techniques are getting easier is precisely why the disciplined basics matter — and why they work.

What you should actually do

Enough theory. Here’s the practical checklist, in order of importance.

1. Update Zoom on every device, now. This is the entire fix for this specific problem. Make sure every computer and phone in your business that runs Zoom is on the latest version. Don’t forget the easily-overlooked ones — the laptop that only gets used for the occasional call, the conference-room system, the personal phone an employee uses for work meetings. A single un-updated device is the one that stays vulnerable.
2. Turn on automatic updates wherever you can. The deeper lesson of this story is that the window between a flaw becoming public and criminals trying to use it is shrinking fast. Waiting weeks to update is a gamble you increasingly can’t afford. Automatic updates mean the fix arrives without depending on a busy person remembering to install it.
3. Apply the same thinking to all your software. Zoom is today’s example, but the principle is universal. Your web browser, your operating system, your other business applications — every one of them occasionally has a flaw like this, and every one periodically ships a fix. The businesses that stay safe are simply the ones where updates get applied promptly and consistently, everywhere.
4. Know what you’re running. You can’t update what you’ve forgotten you have. Part of staying protected is simply knowing every device and major piece of software in your business, so that when an urgent fix like this one lands, you know exactly what needs attention and nothing slips through the cracks.

That last point is where most small businesses quietly fall down — not out of carelessness, but because in a busy company without dedicated IT, “make sure every device and every application is current” is a job that belongs to no one in particular. So it gets done sometimes, on some machines, when someone happens to think of it. And that’s precisely the gap these ever-faster threats are built to find: the one laptop that missed the update, the conference-room system nobody thought to check, the app that’s three versions behind.

Closing that gap is exactly what our managed IT service is built to do. We keep every device and application across your business current — automatically, verifiably, and without anyone on your team having to track security bulletins or remember to click “update.” When a story like this breaks, the question that matters is a simple one: is every device in my business already patched, or am I hoping they are? For the businesses we manage, that’s not a hope — it’s handled. In a world where a single AI-assisted researcher can build a device-takeover exploit in an afternoon, “we’ll get around to updating” is no longer a plan. Making sure the fix is always already in place is. Let’s take that worry off your plate for good.

Sources: A Security (ZOOMSDAY research disclosure); Zoom security bulletins; SecurityWeek; eSecurity Planet; MLQ.ai, August 2026. The three flaws (tracked as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415) affect the annotation function across Zoom clients; Zoom’s fixes are in Workplace 7.1.5 and 7.0.6 and related client versions, with an additional server-side mitigation. Researchers describe the attack as zero-click; Zoom’s advisories list user interaction as required and rate the flaws high severity. Specific technical and exploitation details are omitted here in favor of awareness-level guidance.