Daily Cybersecurity News - February 10, 2026

BeyondTrust has patched a critical remote code execution (RCE) vulnerability, identified as CVE-2026-1731, in its Remote Support and Privileged Remote Access products. The flaw allows unauthenticated, remote attackers to execute arbitrary OS commands; patches are now available and should be applied immediately.

Fortinet has released security updates to address a critical SQL injection vulnerability, identified as CVE-2026-21643, in its FortiClientEMS software. The now-Patched flaw could allow an unauthenticated, remote attacker to execute arbitrary code on affected systems.

A China-linked espionage group, UNC3886, executed a targeted campaign against Singapore's four largest telecom providers. The attackers utilized sophisticated tools to gain access, but a coordinated national response reportedly prevented service disruption and theft of sensitive customer data.

This incident highlights the strategic targeting of critical telecommunications infrastructure by nation-state actors who exploit zero-day vulnerabilities in edge devices to conduct espionage.

Dutch authorities, including the Data Protection Authority (AP) and the Council for the Judiciary (Rvdr), confirmed a data breach after attackers exploited critical zero-day vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM). The incident exposed employee contact information and is part of a wider campaign affecting European government institutions. Crucially, investigations revealed a "soft delete" architectural failure: data marked as deleted was not scrubbed from the database, allowing attackers to access historical records of former employees and decommissioned devices.

Internet-facing management interfaces for enterprise solutions remain high-value targets, and their compromise can lead to significant data exposure even without a full network breach.

A new commercial spyware kit, ZeroDayRAT, is being sold on Telegram, offering cybercriminals full remote control over compromised Android and iOS devices. The malware enables comprehensive data theft, real-time surveillance, and financial theft.

ZeroDayRAT represents the continued commercialization of sophisticated, nation-state-level surveillance tools for a broader criminal audience. Its cross-platform capability to steal banking credentials, intercept 2FA codes, and deploy keyloggers poses a significant financial and privacy threat to mobile users.

Threat actors are actively exploiting critical vulnerabilities in SolarWinds Web Help Desk (WHD) to gain initial access and deploy legitimate tools. Attackers are using the Velociraptor digital forensics tool for command and control, persistence, and remote access on compromised systems.

This campaign demonstrates a tactical shift where attackers abuse trusted incident response and administrative tools to evade detection and maintain control. Attackers deploy an outdated version of Velociraptor (0.73.4) specifically to exploit an embedded vulnerability (CVE-2025-6264). This "Bring Your Own Vulnerable Tool" technique allows them to escalate privileges from the SolarWinds service user to SYSTEM/Administrator.

An investigation into Moltbook, a social network for AI agents, reveals it is not a hub for advanced bot-to-bot conversation but a high-risk environment rife with security flaws, spam, and scams. A major vulnerability exposed sensitive data, including API keys and user emails.

The emergence of platforms like Moltbook highlights a critical new attack surface where autonomous AI agents can be compromised at scale. This incident demonstrates that novel AI-centric environments are being rapidly exploited, moving from theoretical playgrounds to active threat landscapes. Security leaders must prioritize developing governance and threat models for agentic AI systems, as traditional security tools are ill-equipped to monitor or prevent data exfiltration from these trusted, internally-operating agents.