Daily Cybersecurity News – February 24, 2026

SolarWinds has patched four critical remote code execution vulnerabilities in its Serv-U file transfer software that could allow authenticated attackers with high privileges to gain root/admin access. The flaws (including the most severe tracked as CVE-2025-40538) are now addressed in the latest release. Immediate patching is required.

A security analysis of ten popular Android mental health applications, with a combined 14.7 million installations, revealed 1,575 vulnerabilities. These flaws, including 54 high-severity issues, could lead to the exposure of highly sensitive user data, such as therapy records and personal information; it is unclear if the developers have patched the reported flaws.

Ad tech firm Optimizely disclosed a data breach affecting an undisclosed number of customers after attackers gained access to internal systems through a sophisticated voice phishing (vishing) campaign. The incident highlights the effectiveness of social engineering tactics targeting the human element to bypass security controls.

This incident underscores that human-centric social engineering remains a primary vector for initial access, bypassing technical controls to target employee trust and identity verification workflows.

A Russian-speaking hacker used commercial generative AI to compromise over 600 FortiGate firewalls across 55 countries. The campaign targeted credentials and backups, likely as a precursor to ransomware attacks, by exploiting weak credentials on exposed management ports.

This campaign demonstrates how generative AI lowers the barrier for less-skilled actors to achieve operational scale, automating well-known attack techniques rather than creating novel exploits. The focus on backup infrastructure suggests a clear financial motive aimed at disabling recovery before deploying ransomware.

Threat actors are using a convincing, fake Zoom meeting page to automatically trigger a bogus update, which silently installs commercial surveillance software onto victim's machines. This campaign targets unsuspecting users by exploiting their trust in the popular video conferencing platform.

This attack relies on psychological manipulation rather than technical exploits, creating a believable scenario to trick users into accepting a malicious download. The use of legitimate, commercial monitoring software makes detection more challenging for traditional security tools.

Threat actors are using a fraudulent website impersonating Avast to trick users into providing their full credit card details. The scam lures victims with a fake €499.99 charge, promising a refund while actually harvesting their financial and personal information.

This operation combines a static phishing page with interactive fraud by using live chat agents to overcome victim hesitation. The use of JavaScript to display the current date for the fake transaction adds a layer of urgency and believability to the scam.

A dramatic surge in ATM "jackpotting" attacks in 2025 led to over $20 million in losses from more than 700 incidents, as criminals successfully used well-established tools and tactics to force ATMs to dispense cash.

The resurgence of these decade-old attack methods indicates a significant gap in the physical security and legacy system oversight for distributed financial assets. This trend underscores that a failure to maintain fundamental security controls, such as restricting physical access and hardening systems against known malware, can be just as costly as a novel zero-day exploit.