Cybersecurity Brief – 2026-02-19

Thu, 19 Feb 2026 00:00:00 +0000

Major Incidents or Breaches

Figure Technology Solutions suffered a data breach impacting nearly one million accounts, exposing personal and contact information.
Betterment’s data breach is more severe than initially reported, with leaked data including sensitive personal and financial details.
A vast online database containing billions of records, including Social Security Numbers, was found exposed and accessible, posing significant identity theft risks.

Grandstream GXP1600 series VoIP phones are affected by a critical unauthenticated remote code execution vulnerability (CVE-2026-2329), allowing attackers root-level access and enabling call interception, toll fraud, and user impersonation.
Four widely used Microsoft Visual Studio Code extensions (collectively over 125 million installs) were found to contain multiple vulnerabilities, potentially enabling threat actors to compromise developer environments.
Multiple Honeywell CCTV products used in critical infrastructure are vulnerable to an authentication bypass flaw, allowing unauthorized access to video feeds and account hijacking.
Dell RecoverPoint for Virtual Machines is affected by a maximum severity zero-day vulnerability (CVE-2026-22769), exploited since mid-2024 by a China-linked threat group (UNC6201) for lateral movement, persistence, and malware deployment.
Foxit and Apryse PDF platforms contained 16 vulnerabilities that could be exploited for account takeover and data exfiltration via malicious documents or URLs.
CISA has added a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware to its Known Exploited Vulnerabilities (KEV) catalog; the issue was patched in 2024 but is being actively exploited.

The China-nexus threat actor UNC6201 has exploited Dell RecoverPoint for VMs zero-day since mid-2024.
Kenyan authorities reportedly used Cellebrite’s forensic extraction tool against a dissident’s mobile device while in custody.
Telegram underground channels rapidly weaponized SmarterMail vulnerabilities (e.g., CVE-2024-XXXX), sharing PoCs and stolen credentials shortly after public disclosure.
New Keenadu Android malware has been found preinstalled on thousands of devices and distributed via Google Play and other app stores.
Hackers are actively exploiting a vulnerability in TeamT5’s ThreatSonar Anti-Ransomware product.
AI platforms such as Grok and Microsoft Copilot are being abused as covert communication channels for malware command-and-control (C2) activity.

AI and quantum advancements are driving recommendations for substantially longer passwords (25+ characters) to withstand brute-force and future cryptanalytic attacks.
AI-powered chatbots are being weaponized for scams, including a fake “Gemini” chatbot used to pitch fraudulent “Google Coin” schemes.
Phishing campaigns are leveraging fake Google Forms sites to harvest Google login credentials from job seekers.
Anti-phishing heuristic rules in Microsoft Exchange Online mistakenly blocked legitimate emails and Teams messages, disrupting business communications.
Microsoft 365 Copilot bug has caused confidential emails to be summarized by the AI assistant, bypassing organizations’ data loss prevention policies.
A significant percentage (over 40%) of South Africans reported being scammed in 2025, highlighting the prevalence of scalable, low-friction scams.
Underground threat communities are accelerating the weaponization of disclosed vulnerabilities, as evidenced by rapid exploitation of SmarterMail flaws.
Malware campaigns are increasingly using steganography, such as embedding payloads in image files.

CISA has issued warnings regarding active exploitation of vulnerabilities in Honeywell CCTV products and TeamT5 ThreatSonar Anti-Ransomware, urging immediate patching and mitigation.
CISA’s KEV catalog continues to expand with newly exploited vulnerabilities, reinforcing mandatory remediation timelines for federal and critical infrastructure entities.