In February 2026, Microsoft addressed over 50 security vulnerabilities during its Patch Tuesday update, including six zero-day flaws that were actively exploited by attackers. Notably, three of these zero-days involve security feature bypasses. One of the vulnerabilities, identified as CVE-2026-21513, impacts the MSHTML/Trident browser engine used in Internet Explorer on Windows, while CVE-2026-21514 affects Microsoft Word. Attackers can exploit these vulnerabilities by tricking users into opening malicious files or links. As these security holes are actively being exploited, users and organizations must apply the updates promptly to protect their systems from potential breaches.
A newly discovered vulnerability, identified as CVE-2026-1731, poses a serious risk to users of BeyondTrust software. This flaw allows for remote code execution without the need for user interaction, meaning that attackers could exploit it through relatively straightforward methods. Organizations using BeyondTrust products should take this threat seriously as it could lead to unauthorized access and control over their systems. Timely patching is crucial to mitigate the risks associated with this vulnerability, especially since it can be exploited before any authentication takes place. Users are advised to check for updates and apply any available patches immediately to protect their systems from potential attacks.
Hackread – Cybersecurity News, Data Breaches, AI and More
Actively Exploited
During Pride Month, attackers are sending out phishing emails that appear to come from trusted email services like SendGrid. These emails are designed to trick employees into revealing their login credentials. The phishing attempts are happening worldwide, making this a widespread issue that could compromise sensitive information across various organizations. Employees should be cautious and verify the authenticity of such emails before clicking on any links or providing personal information. This incident raises concerns about how attackers exploit timely themes to manipulate users and highlights the need for enhanced email security protocols in workplaces.
BeyondTrust has issued a patch for a serious remote code execution (RCE) vulnerability that affects its Remote Support (RS) and Privileged Remote Access (PRA) products. This vulnerability allows attackers to exploit the systems remotely by sending specially crafted requests, and alarmingly, it does not require authentication to do so. This means that unauthorized users could potentially gain control over affected systems, posing significant risks to organizations using these products. Users and companies should prioritize applying the latest patches to mitigate potential threats. Keeping systems updated is crucial to maintaining security against such vulnerabilities.
Dutch agencies, including the Data Protection Authority and the Council for the Judiciary, have confirmed cyberattacks that exploited vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM). These attacks resulted in the exposure of employee contact data. The flaws in Ivanti EPMM were recently disclosed, allowing attackers to breach the systems of these government bodies. This incident raises concerns about the security of sensitive personal information and the potential for further exploitation of these vulnerabilities. Authorities have reported the incidents to parliament, emphasizing the need for improved security measures in public sector agencies.
A Chinese cyber group known as UNC3886 has targeted Singapore's four major telecom providers using advanced techniques, including rootkits and a zero-day exploit. Fortunately, the attack did not disrupt services or compromise customer data. This incident raises concerns about the security of essential infrastructure, as telecom providers play a critical role in national communication systems. While no direct impact on users was reported, the use of sophisticated methods by attackers emphasizes the need for ongoing vigilance and robust security measures within the telecommunications sector. Companies must remain alert to such threats and ensure their defenses are up to date.
The Dutch Data Protection Authority and the Council for the Judiciary have confirmed that their systems were compromised due to a zero-day exploit of Ivanti Endpoint Manager Mobile (EPMM). This vulnerability, recently disclosed, allowed attackers to access sensitive employee contact information. The breach was reported to parliament on January 29, indicating that it poses a significant risk to the privacy of individuals whose data was exposed. The incident underscores the importance of timely patching and system security, as organizations are urged to address these vulnerabilities to protect against future attacks.
In February 2026, a significant security update was released that addressed 59 Common Vulnerabilities and Exposures (CVEs), including six zero-day vulnerabilities. These vulnerabilities could allow attackers to gain unauthorized access or execute malicious code on affected systems. Various products from multiple vendors are impacted, which means a wide range of users, including businesses and individual consumers, could be at risk. The presence of zero-day vulnerabilities indicates that attackers could exploit these weaknesses before users have the chance to apply the necessary patches. Companies and users are urged to update their systems promptly to mitigate potential risks associated with these vulnerabilities. Ignoring these updates could expose them to serious security breaches.
Recent testing has shown that the speaker in Apple's AirTags can be easily disabled using a common tool, like a spudger, in less than two minutes. This raises significant privacy concerns, as disabling the speaker could prevent users from hearing alerts that the device is tracking them. This situation is particularly alarming for individuals who might be targeted for unwanted tracking or stalking, as it could allow malicious actors to exploit the AirTags without detection. While Apple has marketed these devices as a way to help users locate lost items, this vulnerability could undermine their intended purpose. Users and privacy advocates are urging Apple to address this issue to enhance the security features of the product.
A group known as TeamPCP has been targeting cloud infrastructures with automated attacks that resemble worm-like behavior. These attacks exploit exposed services and interfaces, allowing the attackers to compromise cloud environments on a large scale. Organizations using cloud services need to be particularly vigilant, as these automated attacks can lead to significant data breaches and operational disruptions. The scale of these attacks poses a serious risk to businesses that may not have adequate security measures in place to protect their cloud environments. Companies are urged to strengthen their defenses against these types of vulnerabilities to prevent falling victim to such automated threats.
Hackers are exploiting vulnerabilities in SolarWinds Web Help Desk (WHD) to gain unauthorized access to systems. This allows them to execute code on affected machines, deploying legitimate forensic tools like Velociraptor to maintain persistence and enable remote control. Organizations using SolarWinds WHD should be particularly vigilant, as these vulnerabilities can lead to serious security breaches. The situation underscores the need for companies to regularly update and patch their systems to protect against such attacks. Users of the software must act quickly to ensure their environments are secure.
SmarterTools has reported that its network was breached by the Warlock ransomware gang, which gained access through a vulnerability in the company's email system. Fortunately, this incident did not compromise any business applications or account data, meaning that sensitive user information remains secure. However, the breach raises concerns about the security of email systems and the potential for ransomware attacks targeting software vulnerabilities. Organizations using SmarterTools should review their email security practices and ensure they are employing appropriate safeguards against such threats. This incident serves as a reminder that even established software can have weaknesses that attackers might exploit.
BeyondTrust has addressed a serious remote code execution vulnerability, identified as CVE-2026-1731, which affects its Remote Support (RS) and Privileged Remote Access (PRA) solutions. This vulnerability can be exploited without authentication, making it particularly dangerous for self-hosted customers. BeyondTrust is urging users to apply the patch immediately to protect their systems. Unlike a previous zero-day vulnerability exploited by threat actors linked to China, this issue was discovered by a security researcher and disclosed privately. The prompt action by BeyondTrust highlights the necessity for timely vulnerability management in remote access tools, which are critical for many organizations.
Researchers from SecurityScorecard have discovered that over 40,000 instances of OpenClaw, a software tool, are exposed to potential attacks. This exposure raises significant security concerns, as it could allow attackers to exploit these deployments for unauthorized access or data breaches. OpenClaw is used in various applications, and organizations relying on it need to ensure their systems are secure. The large number of exposed instances suggests that many users may not be aware of the vulnerabilities associated with their deployments. Companies should prioritize reviewing their OpenClaw configurations and take steps to secure their systems against possible exploitation.
A recent investigation uncovered over 150 domains impersonating law firms as part of a scam that uses artificial intelligence. These fake websites are designed to deceive individuals and businesses by mimicking legitimate legal services. The scammers aim to exploit unsuspecting victims, potentially leading to financial losses and legal complications for those who engage with these fraudulent sites. This incident raises concerns about the effectiveness of current cybersecurity measures and the challenges of identifying AI-generated content. As cybercriminals increasingly utilize advanced technology, it becomes essential for both users and legal professionals to remain vigilant against such impersonation schemes.