Isometric network nodes depicting VoIP vulnerabilities, data breaches, and AI detection.

Daily Cybersecurity News - February 19, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

February 19, 2026 5:47 PM 6 min read

Grandstream VoIP Flaw Exposes Networks

Critical

Executive Summary

A critical, unauthenticated stack-based buffer overflow vulnerability, CVE-2026-2329, has been discovered in Grandstream GXP1600 series VoIP phones. This flaw allows remote attackers to execute code with root privileges, enabling call interception and credential theft; a patch is now available.

Vulnerability Details

Affected Product: Grandstream GXP1600 series (GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, GXP1630) with firmware versions 1.0.7.79 and earlier.
Identifier: CVE-2026-2329
CVSS Score: 9.3 (Critical).
Exploitation Status: Proof-of-concept exploit modules are publicly available via Metasploit.

Risk & Impact

Triage: Immediate. The public availability of an exploit for an unauthenticated RCE vulnerability warrants urgent patching.
Attack Vector: An unauthenticated attacker can send a specially crafted request to the device's web-based API to trigger a buffer overflow. This allows for remote code execution with root privileges, call interception by rerouting to a malicious server, and theft of stored credentials.
Ease of Exploit: Low. The vulnerability is accessible in the default configuration and does not require any authentication, lowering the barrier for attackers.

Action Plan

Immediate Action: Upgrade all affected GXP1600 series devices to firmware Version 1.0.7.81 or later.
Workaround: If patching is not immediately possible, ensure the device's web management interface is not exposed to the internet or untrusted networks.
Detection: Monitor for unusual network traffic to and from the web management interface of VoIP devices. Analyze logs for unexpected reconfigurations or access from unknown IP addresses.

Relevant professional terms

VoIP (Voice over Internet Protocol): A technology that enables voice and multimedia communications to be delivered over the internet, rather than traditional telephone lines. It works by converting analog voice signals into digital data packets that are transmitted across an IP network.
Toll Fraud: The unauthorized use of a company's telecommunications system to generate high-volume, expensive calls, often to international premium-rate numbers. Attackers exploit vulnerabilities in systems like VoIP to make these calls, with the victim organization being billed for the charges.

Source: Dark Reading

Mozilla Patches Critical Memory Flaws

High

Executive Summary

Mozilla has released security updates to address several memory safety bugs, identified as CVE-2023-6864, which have been patched. These vulnerabilities showed evidence of memory corruption that could be exploited to run arbitrary code.

Vulnerability Details

Affected Product: Firefox versions prior to 121, Firefox ESR versions prior to 115.6, and Thunderbird versions prior to 115.6.
Identifier: CVE-2023-6864
CVSS Score: 8.8 (High)
Exploitation Status: No known exploits are available.

Risk & Impact

Triage: Immediate patching is recommended due to the high potential for arbitrary code execution.
Attack Vector: An attacker could exploit these vulnerabilities by tricking a user into visiting a specially crafted, malicious website. Successful exploitation could lead to memory corruption and allow the execution of arbitrary code.
Ease of Exploit: Exploitation requires user interaction and a skilled attacker to craft a functional exploit from the memory corruption bugs.

Action Plan

Immediate Action: Update to Firefox 121, Firefox ESR 115.6, or Thunderbird 115.6.
Workaround: No specific workarounds have been provided; updating the software is the only recommended mitigation.
Detection: There are no specific Indicators of Compromise (IOCs) associated with this vulnerability. Monitor for unexpected browser crashes or behavior.

Relevant professional terms

Memory Corruption: An unintended modification of memory contents due to programming errors, which can lead to system crashes or create security vulnerabilities that an attacker could exploit.
Arbitrary Code Execution: An attacker's ability to execute any commands or code of their choice on a target machine or in a target process. This is one of the most severe effects of a software vulnerability.

Source: Mozilla Foundation Security Advisory

Betterment Breach Exposes Client Data

Executive Summary

In January 2026, investment platform Betterment suffered a data breach where attackers used social engineering to access a third-party marketing system. This exposed the sensitive personal data of approximately 1.4 million customers, which was then used to launch fraudulent crypto-themed phishing campaigns.

Attack Overview

Attack Path: Attackers used social engineering and identity impersonation to gain access to third-party marketing and operations platforms.
Attacker: The threat group ShinyHunters has claimed responsibility for the attack.

Impact Assessment

Data Stolen: Exposed data for 1.4 million customers included full names, email addresses, phone numbers, physical addresses, dates of birth, and employment details.
Operational Impact: The company experienced a temporary DDoS attack, suspected to be a diversion tactic.

Strategic Takeaway

This incident highlights how human-centered vulnerabilities, like social engineering, can bypass technical controls to compromise sensitive data within third-party systems.

Relevant professional terms

Social Engineering: A manipulation technique used by attackers to deceive individuals into divulging confidential information or performing specific actions.
Phishing: A type of cyberattack where criminals send fraudulent messages, often emails, designed to trick a victim into revealing sensitive information.

Source: Malwarebytes

Arkanix Stealer Expands Via MaaS Platform

Executive Summary

Arkanix is an information stealer, distributed as a Malware-as-a-Service (MaaS), designed to exfiltrate a wide range of sensitive data. Operators leverage Discord and online forums to advertise the malware, which has rapidly evolved from Python to a more advanced C++ variant.

Key TTPs

Initial Access: Distributed via Discord and online forums, masquerading as legitimate software or game cracks to trick users into execution.
Execution: The initial Python version uses Nuitka to create a standalone executable that fetches and runs the main payload from memory.
Defense Evasion: Employs VMProtect for obfuscation and uses a tool called "Chrome Elevator" to perform process injection into browser processes, bypassing App-Bound Encryption (ABE).

Campaign Analysis

Arkanix demonstrates a rapid development cycle, with its operators quickly releasing a more capable C++ "Premium" version to maximize profitability. The MaaS model, complete with a web panel and invite-only access, lowers the barrier to entry for criminals seeking to steal credentials for financial gain.

Targeting & Infrastructure

Target Profile: The malware targets a wide range of data, including credentials from Chromium-based browsers, cryptocurrency wallets, VPN clients, and gaming applications like Steam.
Infrastructure: C2 operations and a user management panel are hosted at arkanix[.]pw, with distribution and customer support handled primarily through Discord.

Relevant Terms

Malware-as-a-Service (MaaS): A subscription-based model where cybercriminals rent or buy malware from developers, who maintain the tool and its infrastructure.
Process Injection: A defense evasion technique where a malicious actor runs code within the address space of a legitimate process to hide its activity.

Source: Securelist

Texas Sues Router Giant Over Deception

Executive Summary

The Texas Attorney General has filed a lawsuit against networking equipment company TP-Link, accusing it of deceptively marketing its routers as secure while having vulnerabilities allegedly exploited by Chinese state-sponsored hackers.

The Scheme

TTP 1: Deceptively marketing products as secure despite known firmware vulnerabilities.
TTP 2: Misleading consumers by labeling products "Made in Vietnam" when most components are sourced from China.
TTP 3: Exploiting router vulnerabilities to install malicious firmware implants and create botnets for cyberattacks.

The Players

Threat Actor: Camaro Dragon (Mustang Panda)

The Consequence

Outcome: Lawsuit filed seeking civil monetary penalties of up to $10,000 per violation and injunctions.

Strategic Takeaway

This legal action signifies a growing trend of holding hardware manufacturers accountable for security flaws and supply chain transparency, particularly when they can be exploited by nation-state actors.

Relevant Terms

Firmware Vulnerabilities: Security flaws in the permanent software programmed into a hardware device's read-only memory, which can be exploited by attackers to take control of the device.
State-Sponsored Hackers: Threat actors who act on behalf of a government to conduct cyberattacks, espionage, or other malicious activities against foreign nations or entities.

Source: BleepingComputer

AI Automates Azure Threat Detection

Executive Summary

Wiz Research has developed a new methodology using Large Language Models (LLMs) to automatically detect and surface malicious Azure OAuth applications. This approach proactively identifies emerging consent phishing campaigns that often go unnoticed.

Key Features

Proactively detects emerging malicious OAuth applications.
Identifies large-scale campaigns impersonating well-known brands.
Analyzes applications for suspicious permissions and activity patterns.

Use Case (The "So What?")

For Blue Teams and SOCs, this AI-driven approach automates the manual hunt for consent phishing. It allows security teams to rapidly identify and neutralize malicious OAuth applications that grant attackers persistent access to corporate environments, significantly reducing the risk of privilege escalation and data breaches.

Availability

This detection capability is integrated into the commercial Wiz Cloud Native Application Protection Platform (CNAPP).

Relevant Terms

OAuth: An open-standard authorization protocol that allows applications to obtain requested access to user data without sharing passwords.
Consent Phishing: A social engineering attack where attackers trick users into granting a malicious application permissions to access their sensitive data or accounts.

Source: Wiz.io Blog