Good morning. This is your security briefing for Wednesday, February 18, 2026, covering ten articles analyzed overnight. All attribution is by the article authors. All article analysis is automated.
We have a critical security alert. CVE-2026-22769, a vulnerability in root, has been added to the CISA Known Exploited Vulnerabilities catalog.
Bitsight Research has published an analysis of China's national vulnerability databases CNVD and CNNVD, revealing they operate as separate ecosystems from CVE with unique vulnerability disclosures. Some vulnerabilities appear in Chinese databases before CVE or never appear in CVE at all, with Chinese databases often reporting lower severity scores, potentially creating blind spots for Western organizations relying solely on CVE.
Security researcher Luke Paris on Medium has reverse-engineered the password encryption mechanism used by MultiDesk RDP client versions 3.16 and 14.0. The research demonstrates how encrypted passwords stored in configuration files can be decrypted using encryption keys stored in the Windows registry, allowing attackers with local access to retrieve plaintext credentials.
Labs at ITRES has identified a supply chain vulnerability in JitPack that allows attackers to exploit reborn namespaces by reclaiming abandoned Git usernames and injecting malicious code into dependencies. Real-world targets were identified in the legacy Android ecosystem, including dependencies like com.github.lzyzsd:jsbridge and com.github.apl-devs:appintro, enabling supply chain attacks through trusted-looking malicious dependencies.
A previously private training curriculum called The Mimikatz Missing Manual has been publicly released by darkoperator, providing detailed documentation on Windows authentication protocols, Kerberos, and PKI mechanisms exploited by the Mimikatz credential theft tool. The manual targets red teams for offensive operations, blue teams for detection strategies, and security researchers studying Windows LSASS internals.
The Acronis Threat Research Unit has uncovered the CRESCENTHARVEST campaign, a cyberespionage operation by an Iranian-aligned threat group targeting Iranian protestors and dissidents. Attackers use social engineering with malicious .LNK files disguised as protest-related media, deploying a remote access trojan via DLL sideloading with signed Google executables for keystroke logging, remote command execution, and data exfiltration.
Amnesty International reports that Predator spyware, developed by mercenary company Intellexa, was used to target prominent Angolan journalist Teixeira CΓ’ndido in 2024 through malicious WhatsApp links. This marks the first confirmed instance of Predator spyware in Angola, with the spyware successfully infecting the journalist's iPhone in May 2024, providing complete device access including encrypted messages, location data, and microphone activation.
Insikt Group has identified the GrayCharlie threat actor, overlapping with SmartApeSG group, hijacking US law firm WordPress websites since mid-2023 through suspected supply-chain attacks. The attackers inject malicious JavaScript to redirect visitors and deliver NetSupport RAT payloads disguised as fake browser updates, with infections sometimes progressing to Stealc and SectopRAT malware, potentially through compromise of third-party vendor SMB Team.
CERT Polska reports that a large Polish organization suffered a company-wide infection through a ClickFix campaign using fake CAPTCHA pages to trick users into executing malicious PowerShell commands. The attack deployed Latrodectus and Supper malware families using DLL side-loading and obfuscation techniques, demonstrating how basic social engineering can enable sophisticated malware deployment and lateral movement.
The Polish Police CBZC has arrested a 47-year-old man as part of Europol's Operation Aether targeting the Phobos ransomware group. The suspect allegedly possessed stolen credentials, passwords, and server IP addresses used to facilitate ransomware attacks, with Phobos operating as Ransomware-as-a-Service and impacting over 1,000 victims worldwide including hospitals, schools, and government contractors, demanding over $16 million in ransoms.
The Citizen Lab reports that Kenyan authorities used Cellebrite mobile forensics technology to extract data from the phone of activist and politician Boniface Mwangi following his arrest in July 2025. The incident demonstrates state surveillance capabilities targeting political opposition and civil society members in Kenya, raising concerns about privacy erosion and potential human rights abuses enabled by commercial surveillance tools.
That concludes today's briefing.