Critical Zero-Days in Dell and Chrome Actively Exploited; CISA Issues Urgent Patch Alerts
Summary
This reporting period for February 16-17, 2026, is dominated by the active exploitation of critical vulnerabilities. Dell disclosed a maximum-severity zero-day in its RecoverPoint appliance, exploited by a Chinese espionage group for nearly two years. Concurrently, Google rushed out a patch for the first actively exploited Chrome zero-day of 2026. CISA amplified the urgency by adding multiple widely-used products from SolarWinds, Microsoft, and BeyondTrust to its KEV catalog. Other significant developments include the discovery of a sophisticated Android backdoor, a novel attack using AI assistants for C2 channels, and a firmware rootkit targeting Cisco devices.
Today New Articles
Dell Zero-Day Exploited for Two Years by Chinese Spies to Steal Data
Dell has released an emergency patch for a critical, maximum-severity vulnerability (CVE-2026-22769) in its RecoverPoint for Virtual Machines appliance. The flaw, a case of hardcoded credentials, has been actively exploited by a suspected Chinese cyberespionag...
Google Scrambles to Patch First Actively Exploited Chrome Zero-Day of 2026
Google has issued an urgent security update for its Chrome web browser to fix a high-severity zero-day vulnerability, CVE-2026-2441. The flaw, a use-after-free bug in the browser's CSS component, is confirmed to be actively exploited in the wild. Successful ex...
‘Zero-Knowledge’ Password Managers Not So Secure, Study Finds
A new study by researchers at ETH Zurich has uncovered significant architectural weaknesses in popular cloud-based password managers, including Bitwarden, LastPass, and Dashlane. The research challenges the "zero-knowledge" encryption promises made by these ve...
CISA KEV Alert: Patch Now for Exploited Flaws in SolarWinds, Microsoft, Notepad++, and Apple
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The flaws affect a wide range of popular products: SolarWinds Web Help Desk (CVE-2025-40536...
New ClickFix Attack Abuses DNS 'nslookup' for Stealthy Malware Delivery
Microsoft Threat Intelligence has uncovered a new variant of the 'ClickFix' social engineering attack that uses DNS queries as a covert channel for malware delivery. Victims are tricked into running an 'nslookup' command that queries an attacker-controlled DNS...
Microsoft 365 Admin Center Outage in North America Investigated as Security Event
A significant service disruption on February 10, 2026, that prevented IT administrators across North America from accessing the Microsoft 365 admin center, is reportedly being investigated as a security event. The outage, which also affected the M365 mobile ap...
New 'Keenadu' Android Backdoor Injects into Core Zygote Process, Links Major Botnets
Kaspersky researchers have discovered a highly sophisticated Android backdoor named "Keenadu." The malware is being distributed through two alarming vectors: pre-installed in device firmware via supply chain compromise, and through malicious apps on the Google...
Panasonic Launches World-First Cybersecurity Monitoring Trial for Grid-Scale Battery Storage Systems
Panasonic Holdings Corporation has announced the start of what it calls the world's first cybersecurity monitoring trial for grid-scale Battery Energy Storage Systems (BESS). This pioneering initiative aims to develop and validate a system for detecting intrus...
Fake 7-Zip Website Tricks Users, Turns PCs into Malicious Proxy Nodes
A malicious campaign is leveraging a lookalike domain, 7zip[.]com, to distribute a trojanized installer for the popular 7-Zip file archiving utility. The installer, signed with a now-revoked digital certificate, provides a functional version of 7-Zip to avoid...
New 'AI-in-the-Middle' Attack Turns Microsoft Copilot and Grok into C2 Channels
Security researchers have detailed a novel command-and-control (C2) technique dubbed "AI-in-the-Middle." This method allows malware on a compromised system to use legitimate, web-connected enterprise AI assistants, such as Microsoft Copilot, as a proxy to rela...
"Shadow Persistence" Rootkit Targets Cisco Edge Devices, Survives Factory Resets
A sophisticated espionage campaign is actively targeting critical infrastructure and government agencies by exploiting a new vulnerability in Cisco's IOS XE software. Attackers are using the flaw to install a powerful firmware rootkit, dubbed "Shadow Persisten...
Article Updates
BeyondTrust Patches Critical 9.9 CVSS RCE Zero-Day in Remote Access Tools
Update:The critical BeyondTrust RCE vulnerability (CVE-2026-1731) is now being actively exploited in the wild, a significant escalation from its initial disclosure. Following the public release of a proof-of-concept (PoC) exploit on February 10, 2026, widespread scan...