Good morning. This is your security briefing for Saturday, February 21, 2026, covering 15 analyzed articles. All attribution is by the article authors. All article analysis is automated.
Searchlight Cyber disclosed a critical vulnerability in OpenText Directory Services that enables unauthenticated remote code execution through unsafe Java deserialization. The flaw exploits broken cryptographic signature verification, allowing attackers to bypass authentication and potentially compromise all integrated OpenText applications by manipulating cookie components.
Rapid7 Labs disclosed CVE-2026-2329, a critical unauthenticated stack buffer overflow affecting all six models of Grandstream GXP1600 series VoIP phones with firmware prior to version 1.0.7.81. The vulnerability allows remote attackers to achieve root-level code execution without authentication, enabling complete device control, credential theft, and call interception.
Trail of Bits identified critical security vulnerabilities in widely-used AES encryption libraries aes-js and pyaes affecting thousands of downstream projects including strongMan VPN Manager. The libraries use a default Initialization Vector that enables key-IV reuse bugs in AES-CTR mode, allowing attackers to recover XOR of plaintexts, and they lack authenticated cipher modes while remaining vulnerable to cache-timing and padding oracle side-channel attacks.
The Socket Research Team discovered SANDWORM_MODE, a sophisticated npm supply chain worm that hijacks CI workflows and AI toolchains through typosquatting and malicious GitHub Actions. The attack harvests credentials including npm tokens, GitHub secrets, and LLM API keys using multi-stage payloads with data exfiltration via HTTPS, DNS tunneling, and cascading channels, while propagating through npm packages, GitHub repositories, and SSH connections.
According to Bloomberg, Chinese state-sponsored hackers compromised Connect Secure VPN software code, infiltrating nearly two dozen organizations including US civilian federal agencies, military branches, and major financial institutions. The breach prompted an emergency directive in early 2024 mandating immediate disconnection of the VPN software, impacting over 2,000 banks and critical infrastructure organizations.
France's Ministry of Finance reported that a malicious actor gained illegitimate access to the national bank account file FICOBA from late January 2026 using stolen credentials of a civil servant. The breach compromised approximately 1.2 million bank accounts containing personal and financial information including RIB-IBAN details, identities, addresses, and fiscal identifiers, with DGFiP now working with ANSSI to strengthen defenses.
Elliptic reports that the Democratic People's Republic of Korea continues sophisticated cryptocurrency theft operations twelve months after the $1.46 billion Bybit exploit in February 2026. DPRK stole a record $2 billion in cryptoassets in 2025, with 2026 showing accelerated activity including twice as many exploits in January alone, using methods that include targeting exchanges, social engineering, and infiltration via DPRK IT workers who steal funds and install backdoors.
The U.S. Department of Justice charged six individuals in an international ATM jackpotting scheme linked to Tren de Aragua, a designated Foreign Terrorist Organization, bringing total defendants to 93. The operation used malware to compromise ATMs and force cash dispensing, resulting in over $6 million stolen from financial institutions across the United States.
Malwarebytes identified cybercriminals using paid Facebook advertisements to distribute fake Windows 11 installers that deploy malware. The campaign targets home and office users seeking to download or update Windows, stealing passwords, browser sessions, and cryptocurrency wallet data through deceptive websites mimicking official Microsoft download pages.
Check Point Research detailed a novel attack technique called AI in the Middle where threat actors repurpose web-based AI services as command-and-control proxies for malware. The method embeds C2 commands within legitimate-looking requests to AI platforms, allowing attackers to evade traditional security controls and obscure their infrastructure by routing malicious traffic through legitimate AI services.
Security researchers at S12 demonstrated a technique to evade Microsoft Defender remediation by manipulating Windows Protected Process Light protections. The method uses a kernel-mode driver to elevate a malicious process to WinTcb-Light protection level, placing it above Defender's protection level and preventing process termination and file quarantine while detection telemetry may still generate alerts.
CISA released guidance addressing security challenges in legacy industrial Operational Technology communication protocols that lack authentication and protection against data alteration, device impersonation, and unauthorized access. The guidance investigates barriers to adoption of security technologies and provides recommendations for OT asset owners, operators, and manufacturers to secure critical infrastructure systems.
Let's Encrypt introduced DNS-PERSIST-01, a new ACME validation method that uses persistent DNS authorization records instead of per-validation TXT records. The model shifts security focus to ACME account key protection and introduces scope controls including wildcard policy options and optional authorization expiration timestamps, primarily affecting subscribers using wildcard certificates, IoT devices, and multi-tenant platforms.
Idov31 released Nidhogg version 2.0, a multi-functional rootkit for kernel-space operations, with significant updates including a new Text User Interface, expanded Windows support from 22H2 through 25H2, and introduction of Nidhogg Object File format. The update includes enhancements to critical functions like FindPattern and implements backward and forward compatibility mechanisms.
Oracle Linux Blog published technical documentation by Lorenzo Stoakes on the anonymous reverse mapping mechanism in the Linux kernel, explaining how the kernel bridges physical memory to virtual memory addresses. The article details memory management complexities including forking, mremap operations, and VMA merging that affect all Linux processes using anonymous memory.
That concludes today's briefing.