Good morning. This is your security briefing for Tuesday, February 17, 2026, covering 14 articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
We have a critical security alert. CVE-2026-1731, a remote code execution in BeyondTrust Remote Support and Privileged Remote Access, has been added to the CISA Known Exploited Vulnerabilities catalog.
The National Cyber Security Centre reports active exploitation of two critical Ivanti EPMM vulnerabilities, CVE-2026-1281 and CVE-2026-1340, enabling remote code execution. Unauthenticated attackers exploited these flaws to access the MobileIron File Service database containing sensitive credentials and personal data, with evidence suggesting possible zero-day exploitation dating back to August 2025. Multiple Dutch organizations have been confirmed as victims.
Silverfort has disclosed CVE-2025-60704, a Kerberos delegation vulnerability affecting Active Directory environments that allows privilege escalation from low-privileged users to domain administrators. The vulnerability targets sensitive machine identities including domain controllers and PKI servers, which are often not configured as non-delegable despite protecting similar user accounts. Defenders should identify Tier 0 infrastructure and configure sensitive machine accounts using PowerShell to set the ADS_UF_NOT_DELEGATED bit.
Notepad++ released version 8.9.2 addressing a vulnerability where state-sponsored hackers hijacked the update mechanism to potentially distribute malicious updates. The release implements a double-lock security system with dual verification of signed XML from the update server and signed installers from GitHub, plus hardened the WinGUp auto-updater by removing DLL side-loading risks and unsecured SSL options.
Google Cloud reports that threat actor UNC6201 is actively exploiting a critical zero-day vulnerability in Dell RecoverPoint for Virtual Machines, CVE-2026-22769, with a CVSS score of 10.0, since mid-2024. The actor achieves lateral movement, establishes persistence, and deploys multiple malware families including SLAYSTYLE, BRICKSTORM, and the newly discovered GRIMBOLT backdoor.
NIST's Center for AI Standards and Innovation has launched the AI Agent Standards Initiative to develop industry-led standards and protocols for autonomous AI agents. The initiative focuses on creating security and interoperability standards, advancing research in AI agent security and identity, and promoting trusted adoption through open-source protocols and international standards leadership.
A proof-of-concept published on infosec.pub demonstrates a BYOVD attack using 360 Security's WFP driver to block or throttle network connections for EDR and XDR solutions. The vulnerability allows any administrator-privileged process to manipulate WFP filtering rules through unauthenticated IOCTL commands on device objects, effectively creating denial-of-service conditions at the network level.
A tool called ADWSDomainDump has been released on GitHub by mverschu that extracts information from Active Directory using Active Directory Web Services instead of LDAP. The tool has demonstrated evasion capabilities against Microsoft Defender for Endpoint and CrowdStrike Falcon, making it useful for adversaries conducting reconnaissance without immediate detection by using the ADWS protocol on port 9389.
Origin Technology and Prelude have documented Process Preluding, a defense evasion technique that exploits timing vulnerabilities in Windows legacy process creation APIs to inject malicious code into child processes before endpoint security software can monitor them. This technique affects Windows 10 and Windows 11 systems by capitalizing on the narrow window between process object creation and thread initiation. Defenders can mitigate this by flagging processes created via legacy APIs and implementing earlier threat-intelligence logging.
Haaretz reports that Israeli companies have developed advanced cyber tools called CARINT that exploit vehicle technology for surveillance by hacking into car systems and extracting data transmitted from SIM cards to the cloud. The tools collect intelligence from hands-free systems, tire-pressure sensors, and other connected car systems, turning vehicles into surveillance devices without owner consent.
The Objective-See Foundation has documented ClickFix social engineering attacks where threat actors manipulate victims into pasting malicious commands into terminal applications on macOS and Windows systems. This technique bypasses macOS Gatekeeper and Notarization protections by exploiting user trust rather than software vulnerabilities. A proposed defense involves intercepting paste operations into terminal applications to allow users to confirm actions before execution.
SpecterOps has released CAPSlock, an offline analysis tool for Microsoft Entra ID Conditional Access policies. The tool helps red teamers identify policy bypasses and blue teamers audit policy configurations by simulating sign-in scenarios and exposing enforcement gaps caused by policy complexity.
A tool called ksentinel has been published on GitHub by MatheuZSecurity that detects rootkit activities by monitoring syscall table integrity, function prologues, and kernel hooks. The tool provides detection capabilities for sophisticated rootkits using techniques like ftrace hooks, kprobes, and syscall hijacking across x86_64 and ARM64 architectures, though it requires loading into a clean system and provides detection only, not prevention or removal.
Kaspersky Lab has identified Keenadu, a sophisticated Android backdoor that embeds itself in device firmware by compromising the libandroid_runtime.so library and hooking the Zygote process. The malware has affected over 13,715 users globally across multiple device manufacturers, primarily in Russia, Japan, Germany, Brazil, and the Netherlands, and is distributed through firmware compromises, modified apps, and other botnets like BADBOX.
Huntress reports a sophisticated intrusion that utilized ClickFix social engineering to deploy Matanbuchus 3.0 loader and a newly identified remote access trojan called AstarionRAT. The attackers achieved domain controller compromise in approximately 40 minutes using lateral movement techniques including RDP and PsExec, while creating rogue administrator accounts and attempting to evade detection through Defender exclusions.
That concludes today's briefing.