Microsoft has patched a high-severity remote code execution (RCE) vulnerability in the modern Windows Notepad application, tracked as CVE-2026-20841, as part of its February 2026 Patch Tuesday release cycle. The flaw, rooted in command injection, was originally discovered by Cristian…
Tag: Cyber Security News
PentAGI – Automated AI-Powered Penetration Testing Tool that Integrates 20+ Security Tools
PentAGI introduces an AI-driven approach to penetration testing, automating complex workflows with tools like Nmap and Metasploit while generating detailed reports. Developed by VXControl and released on GitHub in early 2025, this open-source platform empowers security professionals to conduct autonomous…
Ongoing Campaign Targets Microsoft 365 to Steal OAuth Tokens and Gain Persistent Access
An ongoing phishing campaign that targets Microsoft 365 users by abusing OAuth tokens to gain long‑term access to corporate data, which focuses on business users in North America and aims to compromise Outlook, Teams, and OneDrive without directly stealing passwords.…
Google Issues Emergency Chrome Security Update to Address High-Severity PDFium and V8 Flaws
A significant security update for the Chrome Stable Channel to address multiple vulnerabilities, including high-severity flaws affecting the browser’s core engines. The tech giant announced the rollout of versions 145.0.7632.109/110 for Windows and Mac, as well as 144.0.7559.109 for Linux.…
Splunk Enterprise for Windows Vulnerability Let Attackers Hijack DLLs and Gain SYSTEM Access
Splunk has disclosed a high-severity vulnerability in Splunk Enterprise for Windows that allows a low-privileged local user to escalate their privileges to SYSTEM level through a DLL search-order hijacking attack. Tracked as CVE-2026-20140 and published on February 18, 2026, under…
OpenClaw’s Top Skill is a Malware that Stole SSH Keys and Opened Reverse Shells in 1,184 Packages
The most downloaded AI agent skill on OpenClaw’s ClawHub marketplace was functional malware, not a productivity tool. OpenClaw, an open-source AI agent platform, operates a public skill marketplace called ClawHub, where third-party developers can publish plugins, or “skills,” that extend…
Adidas Investigates Alleged Data Breach – 815,000 Records of Customer Data Stolen
Adidas has confirmed it is actively investigating a potential data breach involving one of its independent third-party partners after a threat actor operating under the alias “LAPSUS-GROUP” posted claims on BreachForums on February 16, 2026, alleging unauthorized access to the…
OpenClaw’s Top Skill is a Malware that Stole SSH Keys, and Opened Reverse Shells in 1,184 Packages
The most downloaded AI agent skill on OpenClaw’s ClawHub marketplace was functional malware, not a productivity tool. OpenClaw, an open-source AI agent platform, operates a public skill marketplace called ClawHub, where third-party developers can publish plugins, or “skills,” that extend…
Beyond CVE China’s Dual Vulnerability Databases Reveal a Different Disclosure Timeline
The emergence of a distinct vulnerability disclosure ecosystem within China has introduced a complex layer to the global threat landscape. Unlike the centralized CVE system used internationally, China maintains two separate databases—the CNVD and CNNVD—which operate with different disclosure timelines…
PromptSpy – First Known Android AI Malware Uses Google’s Gemini for Decision-making
The first known Android malware family to weaponize a generative AI model, specifically Google’s Gemini, as part of its active execution flow. Discovered in February 2026, the malware represents a significant evolutionary step in mobile threats and follows ESET’s earlier…
Selective Thread Emulation and Fuzzing Expose DoS Flaws in Socomec DIRIS M-70 IIoT Device
Security researchers have uncovered six critical denial-of-service vulnerabilities in the Socomec DIRIS M-70 industrial gateway used for power monitoring and energy management in critical infrastructure. The flaws were discovered through an innovative emulation technique that bypassed hardware debugging limitations by…
Hackers Leveraging Emoji Code to Hide Malicious Code and Evade Security Detections
Threat actors have begun using an obfuscation technique called emoji smuggling to hide malicious code from security systems. This attack method exploits Unicode encoding and emoji characters to bypass traditional security filters that scan for suspicious ASCII text patterns. Standard…
XWorm Malware Delivered via Fake Financial Receipts Targeting Windows Systems to Steal Logins and Sessions
A sophisticated multi-stage malware campaign is actively targeting Brazilian and Latin American (LATAM) businesses using fake bank receipts to deliver XWorm v5.6, a commodity remote access trojan (RAT) capable of stealing credentials, hijacking sessions, and enabling downstream ransomware deployment. The…
AI Dev Tool Cline’s npm Token Hijacked by Hackers for 8 Hours
A compromised publish token gave attackers brief but concerning access to the Cline CLI npm package, exposing developers who installed it during an 8-hour window on February 17, 2026. The incident highlights the growing risk of supply chain attacks targeting…
Critical Authentication Bypass in better-auth API Keys Plugin Allows Unauthenticated Account Takeover
A critical authentication bypass vulnerability in the better-auth API keys plugin allows unauthenticated attackers to mint privileged API keys for arbitrary users. The flaw, tracked as CVE-2025-61928, affects all versions of the better-auth library prior to 1.3.26 — a package…
Microsoft Defender Unveils Centralized Script Library with Copilot Analysis for Enhanced Live Response
Microsoft has introduced a new Library Management experience in Microsoft Defender for Endpoint, designed to fundamentally transform how security analysts manage the scripts and tools they rely on during live response investigations. Announced on February 16, 2026, the enhancement addresses…
Advanced Crypto Mining Malware Spreads Through External Drives and Air-Gapped Systems
A sophisticated cryptocurrency mining campaign has emerged, targeting systems through external storage devices with the ability to compromise even air-gapped environments. The malware operates as a multi-stage infection that prioritizes mining Monero cryptocurrency while establishing persistent mechanisms to resist removal.…
MCP Servers can be Exploited to Execute Arbitrary Code and Exfiltrate Sensitive Data
The Model Context Protocol (MCP) emerged as a breakthrough standard in November 2024, designed by Anthropic to seamlessly connect AI assistants with external systems and data sources. This innovation allows Large Language Models (LLMs) to interact with tools and repositories,…
Microsoft Teams to Prompt Mobile Users for Browser Choice with Non-Office and PDF Links
Microsoft is rolling out a significant update to Teams Mobile on Android and iOS that changes how non-Office and PDF links are handled within the app. Beginning in late February 2026, users will be presented with a browser selection prompt…
Guardian AI-Penetration Testing Tool Connects Gemini, GPT-4 with 19 Security Tools Including Nmap
A new open-source framework is reshaping how security professionals approach penetration testing by placing multiple large language models directly at the helm of automated security assessments. Guardian, developed by Zakir Kun and available on GitHub, is an enterprise-grade AI-powered penetration…