Microsoft's February 2026 Patch Tuesday addresses 54 vulnerabilities, including six zero-day vulnerabilities that are actively exploited. This update includes a critical fix for CVE-2026-21510, a security feature bypass vulnerability with a publicly disclosed and exploited status.
Vulnerability Details
Affected Product: Windows Shell
Identifier: CVE-2026-21510
CVSS Score: 8.8 (Important)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Immediate action is required due to active exploitation in the wild.
Attack Vector: An unauthenticated, remote attacker can exploit this by convincing a user to open a malicious link or shortcut file. Successful exploitation allows the attacker to bypass security features like Windows SmartScreen prompts.
Ease of Exploit: Requires social engineering to trick a user into opening a malicious file, which then bypasses security warnings.
Action Plan
Immediate Action: Apply the February 2026 security updates released by Microsoft to all affected systems.
Relevant professional terms
Patch Tuesday
An unofficial term for the second Tuesday of each month, when Microsoft and other software vendors release security patches to the public. This consolidated release schedule allows IT administrators to plan for testing and deployment.
Zero-Day Vulnerability
A flaw in software or hardware that is unknown to the vendor or party responsible for fixing it. Attackers can create exploits to leverage this vulnerability before a defense is available, leading to a "zero-day attack."
A critical vulnerability, identified as CVE-2025-40551, in SolarWinds Web Help Desk (WHD) is being actively exploited, allowing attackers to achieve unauthenticated remote code execution. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the flaw to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation.
Vulnerability Details
Affected Product: SolarWinds Web Help Desk (All versions prior to 2026.1)
Identifier: CVE-2025-40551
CVSS Score: 9.8 (Critical)
Exploitation Status: Actively Exploited
Risk & Impact
Triage: Urgent. Immediate patching is required, especially for internet-exposed instances.
Attack Vector: The vulnerability stems from an untrusted data deserialization issue, which allows an unauthenticated attacker to execute arbitrary commands remotely on the host machine. Attackers have been observed using this initial access to deploy legitimate remote management tools like Zoho ManageEngine for lateral movement and persistence.
Ease of Exploit: High. The flaw can be exploited without authentication, making any exposed server a prime target.
Action Plan
Immediate Action: Upgrade to SolarWinds Web Help Desk Version 2026.1 or later.
Workaround: If immediate patching is not possible, ensure that WHD administrative interfaces are not publicly accessible. Place the instance behind a VPN or firewall to remove direct internet access.
Detection: Monitor for suspicious processes spawned by the WHD service, such as PowerShell leveraging BITS for payload downloads. Review WHD log files for signs of compromise and look for the installation of unauthorized remote access tools like Zoho Meetings or Cloudflare tunnels.
Relevant professional terms
Remote Code Execution (RCE)
A type of security vulnerability that allows an attacker to execute arbitrary commands or code on a remote machine over a network, without prior authorization. It is considered one of the most severe classes of vulnerabilities.
Attack Surface
The total number of all possible points, or attack vectors, where an unauthorized user can try to enter or extract data from a system. Minimizing the attack surface, for example by not exposing applications to the public internet, is a key security principle.
Muddled Libra Leverages Social Engineering for Data Theft
Executive Summary
The cybercrime group Muddled Libra (also known as Scattered Spider) uses sophisticated social engineering and "living off the land" techniques to infiltrate organizations. They primarily target IT help desks to gain initial access, ultimately aiming to exfiltrate data for extortion.
Key TTPs
Initial Access: Employs vishing (voice phishing) and smishing to manipulate IT help desk staff into resetting passwords and MFA credentials.
Execution: Leverages legitimate remote monitoring and management (RMM) tools and existing infrastructure to blend in with normal network traffic.
Defense Evasion: Bypasses endpoint detection and response (EDR) by exploiting vulnerabilities or using stolen certificates to forge tickets.
Campaign Analysis
Muddled Libra has evolved from focusing on cryptocurrency holders to a broader ransomware affiliate model, increasing the speed and impact of its attacks. The group is highly adaptive, minimizing malware use in favor of exploiting human psychology and legitimate system tools.
Targeting & Infrastructure
Target Profile: Government, retail, insurance, aviation, technology, and telecommunications sectors.
Infrastructure: Focuses on compromising domain controllers, VMware vSphere environments, and cloud service providers like AWS and Azure.
A large-scale campaign active since March 2025 uses a novel loader, RenEngine, delivered via cracked video games to distribute information-stealing malware. The multi-stage infection chain ultimately deploys HijackLoader and payloads like Lumma and ACR Stealer to harvest credentials and cryptocurrency wallets from over 400,000 victims globally.
Key TTPs
Initial Access: Distribution of cracked or modded game installers on piracy websites.
Execution: Malicious Python scripts are executed by a legitimate Ren'Py game engine launcher.
Defense Evasion: HijackLoader uses DLL side-loading, module stomping, and process doppelgänging to conceal its activity.
Campaign Analysis
This operation demonstrates significant maturity, evolving its payloads and using a modular, multi-stage architecture to bypass security controls. The use of a legitimate game engine as a host allows the initial loader to masquerade as normal application behavior, hindering detection.
Targeting & Infrastructure
Target Profile: Users of pirated software, primarily targeting gamers downloading cracked versions of popular titles like FIFA and Far Cry.
Infrastructure: The campaign leverages piracy-related domains to host malicious installers.
Actionable Intelligence
IPs:78.40.193.126
Domains:dodi-repacks.site
Relevant Terms
Stealer: A type of malware designed to collect and exfiltrate sensitive information, such as login credentials, financial data, and cryptocurrency wallet files, from a victim's computer.
DLL Side-Loading: A defense evasion technique where an attacker places a malicious DLL in a location where a legitimate application will load it, allowing the malicious code to be executed within a trusted process.
A newly discovered botnet, dubbed SSHStalker, is targeting Linux systems by blending decade-old exploitation techniques with modern automation. The operation uses the classic Internet Relay Chat (IRC) protocol for resilient command-and-control (C2) communications.
Key TTPs
Initial Access: Automated SSH scanning and brute-forcing weak credentials.
Execution: Compiles payloads directly on the victim host after downloading the necessary GCC tool.
Defense Evasion: Employs log cleaners and rootkit-class artifacts to hide its presence.
Campaign Analysis
SSHStalker represents a scale-first operation, prioritizing resilience over stealth by using noisy but effective methods like per-minute cron jobs for persistence. While it possesses DDoS and cryptomining capabilities, the botnet currently appears to be in a dormant or staging phase, focused on expanding its network.
Targeting & Infrastructure
Target Profile: Primarily legacy or unmaintained Linux systems, often found in cloud hosting environments like Oracle Cloud.
Infrastructure: The botnet has compromised approximately 7,000 systems globally and uses public IRC networks for C2.
Relevant Terms
C2 (Command and Control): The server infrastructure that attackers use to send commands to and receive data from compromised devices (bots).
Botnet: A network of private computers infected with malicious software and controlled as a group without the owners' knowledge, e.g., to send spam or launch DDoS attacks.
Researchers have demonstrated a new attack, called CHAI (Command Hijacking Against Embodied AI), where malicious text on physical signs can manipulate the behavior of autonomous systems like drones and robotic cars. This moves prompt injection attacks from the digital world into the physical environment.
Key Findings
The CHAI attack achieved a success rate of up to 81.8% against autonomous driving models and 95.5% in aerial object tracking simulations.
The attack works by placing deceptive natural language instructions in the environment, which are then read by the AI's perception system and treated as commands.
Physical, real-world tests with a robotic vehicle were successful, proving the attacks are not just theoretical and can override the vehicle's navigation.
The attack framework optimizes both the text of the prompt and its visual properties (color, size, location) to maximize effectiveness.
The Bottom Line
This research reveals a critical new attack surface for AI systems that interact with the physical world. As Large Vision-Language Models are integrated into autonomous vehicles and drones, the potential for adversaries to manipulate them through simple, low-cost physical signs poses a significant threat. Securing these systems now requires validating inputs not just from digital sources, but from the physical environment itself.
Relevant Terms
Prompt Injection: A cybersecurity exploit where an attacker embeds malicious instructions within seemingly normal text or visual inputs to manipulate an AI model's behavior.
Embodied AI: A field of artificial intelligence focused on creating agents, like robots or autonomous cars, that can perceive, reason about, and physically interact with their environment.
Zen AI Pentest is an open-source framework that uses autonomous AI agents to orchestrate and automate the penetration testing lifecycle. It integrates with standard security tools to streamline assessments from reconnaissance to reporting.
Key Features
Autonomous Agents: Employs AI agents to manage distinct phases of a security assessment.
Full Lifecycle Orchestration: Manages sequences of reconnaissance, vulnerability scanning, exploitation, and reporting.
CI/CD Integration: Supports integration with GitHub Actions, GitLab CI, and Jenkins for DevOps pipelines.
Use Case (The "So What?")
Red teams can use this framework to accelerate attack simulations by automating initial discovery and exploitation. Blue teams can adopt it for continuous, automated validation of their security posture, enabling them to find and fix weaknesses proactively.
Availability
The tool is available as a free, open-source project on GitHub.
Relevant Terms
Reconnaissance: The initial phase of a security assessment focused on gathering information about a target system.
Penetration Testing: A simulated cyberattack against a system to identify and exploit security vulnerabilities.
