Security incidents in February 2026

Attackers used an old Cisco SD-WAN flaw to gain full control after obtaining access. It affects business network equipment. Ask your network provider to install a current fixed release and investigate for existing compromise.

Attackers used a login bypass in Cisco Catalyst SD-WAN business-network systems, later linked to KeyDrift malware designed to collect encryption keys. Fixes are available. Ask IT to update all affected components and investigate any earlier compromise.

Two patched Roundcube Webmail flaws are being exploited: one lets logged-in attackers run code on the server; the other runs scripts in users’ browsers. Ask your email provider or IT team to confirm its server is updated and checked for compromise.

Attackers are exploiting an old GitLab flaw that lets people without a login make vulnerable servers contact internal systems. It affects certain old self-managed installations. Ask your IT team to update GitLab to a current supported security release.

Attackers are exploiting an old Zimbra mail-server flaw that can reach internal systems when the WebEx add-on and JSP feature are enabled. A fix shipped in 8.8.15 Patch 7 in 2020. Ask your email provider or IT team to verify remediation and a supported release.

Attackers used a flaw in TeamT5 ThreatSonar Anti-Ransomware to run commands on its server after gaining administrator access. Update to 3.5.0 or later, or apply Hotfix-20240715. TeamT5 says all affected customers have updated.

Attackers used a built-in password to take over Dell RecoverPoint for Virtual Machines business systems. Ask IT to install 6.0.3.1 HF1 or apply Dell's remediation script, and investigate for existing compromise.

CISA listed an old Windows ActiveX flaw as exploited in February 2026. A malicious page in Internet Explorer can run code on vulnerable systems. Microsoft issued fixes in 2009; replace legacy PCs or ask IT to verify all applicable updates.

Attackers used a FileZen flaw requiring a valid login and antivirus checking to be enabled. V5.0.11 fixes it, but FileZen support ended in March. Ask IT to verify patching, check for compromise and arrange replacement.

Attackers exploited a flaw in Chrome’s handling of web-page styles that could run code inside its sandbox. Chrome, Edge, Opera and Chromebook fixes followed in February. Install your browser’s latest update and restart it.

Attackers hijacked Notepad++ updates to infect selected Windows users. Version 8.8.9 fixed installer verification; 8.9.2 added signed update-instruction checks. Install the current release manually and ask IT to investigate potentially affected work PCs.

Attackers are exploiting a security bypass in SolarWinds Web Help Desk 12.8.8 HF1 and earlier. Organisations running it should upgrade to 2026.1 or later and investigate possible compromise. This is an IT support server update.

Attackers are exploiting an old Microsoft Configuration Manager flaw to run commands without logging in. It affects business device-management servers. Ask IT to verify the revised KB29166583 security update is installed across affected sites.

Six exploited flaws affect Windows and Microsoft Word. Malicious links or documents can bypass protections; other flaws help attackers already on a PC gain control. Install current Windows and Office updates, including Office updates on affected Macs.

Critical BeyondTrust Remote Support and Privileged Remote Access flaw (CVE-2026-1731) lets anyone run commands without logging in. Attacks include ransomware gangs. Cloud customers were patched on 2 Feb; self-hosted IT teams should apply the patch (RS 25.3.2, PRA 25.1.1) now.

Attackers exploited React Native Community CLI development servers reachable over a network. Developers should update affected CLI and server-api packages to 18.0.1, 19.1.2 or 20.0.0 or later in the compatible branch, and restrict server access.

SmarterMail email servers before build 9511 have a no-login remote code flaw (CVE-2026-24423) that ransomware gangs have used, including against SmarterTools itself. Fixed in 9511 and later. Anyone running their own SmarterMail should update to the latest build.

Attackers are exploiting an old GitLab server flaw to send requests into networks behind it. Organisations running affected Community or Enterprise Editions should upgrade to a supported release. Fixes first shipped in 14.3.6, 14.4.4 and 14.5.2.

Two patched FreePBX flaws are being exploited: one bypasses admin passwords; the other lets authenticated users run commands. Ask your business phone-system administrator to update the affected modules, restrict admin access and check for compromise.

Attackers are exploiting a flaw that lets them run commands on SolarWinds Web Help Desk servers without logging in. Organisations running version 12.8.8 HF1 or earlier should upgrade to 2026.1 or later and check for compromise.

A breach of Cegedim’s medical-practice service exposed French patients’ identity and contact details, with sensitive notes in some records. Around 15 million people were reportedly affected. Ask your GP whether your records were involved.

An attacker drained YieldBlox’s Stellar lending pool using inflated collateral prices. About US$7.2 million was frozen, but repayment is unconfirmed. Affected depositors should seek recovery updates through established YieldBlox or Script3 channels.

IoTeX's ioTube bridge was hijacked on 21 Feb 2026: about US$4.4m of reserves stolen, 410m CIOTX minted, chain paused for three days. Most minted tokens frozen; no stolen total recovered is reported. Bridge users can claim compensation. Nothing for other IOTX holders to do.

Hazeldenes’ February cyberattack disrupted Victorian chicken deliveries and exposed personal information. Regular production resumed by 30 March. There is no household software fix; anyone notified should follow the company’s advice.

An attacker used a civil servant's credentials to access details of about 1.2 million French bank accounts. Names, addresses and IBANs were exposed, but not balances or transactions. Watch for convincing bank or tax scams and check statements.

Published CarGurus data includes about 12.5 million email addresses, contact details and finance application information, according to HIBP. CarGurus says the incident is contained. Treat unexpected car finance messages and payment demands cautiously.

Australian court files were accessed by unauthorised offshore transcription staff working through VIQ. Its Australian business has wound down, but investigations remain open. If your case used VIQ, ask your lawyer or court registry whether your information was affected.

A published Canada Goose customer dataset contained about 920,000 records and 582,000 email addresses, including purchases and partial card details. The company found no evidence its own systems were breached. Watch for convincing order-related scams.

Figure customer and loan enquiry records were stolen and published online; HIBP counted about 967,200 email addresses. Some notification recipients also had bank details taken. Check your notice, monitor accounts and credit, and verify unexpected loan-related messages.

Ransomware closed UMMC's 35 Mississippi clinics in February; normal operations resumed on 2 March. November notices warn of possible personal and medical data exposure. Check any notification and ask UMMC whether you are affected.

Flickr says a flaw in a third-party email provider's system may have exposed members' names, emails, usernames, IP addresses, locations and activity. No passwords or card numbers. Watch for phishing that mentions your Flickr account; change reused passwords.

Ransomware hit US payment processor BridgePay on 6 Feb 2026, knocking out card payments for merchants and some council portals. BridgePay says no card data was taken. Services were restored from 28 Feb and the incident closed 27 Apr. Nothing for families to do.

Attackers posing as IT staff stole data on about 6.39 million current and former Odido and Ben customers. The data was later published. Ask Odido what was exposed and verify unexpected calls and messages through its official app or website.

A ransomware attack in early February 2026 encrypted about 400 servers at Rome's Sapienza University (112,500+ students). Systems are restored from backups and the incident is closed. The university found no evidence of data theft. Watch for suspicious emails or calls.

Substack confirmed attackers took account data in October 2025; it surfaced in February 2026. Have I Been Pwned counts about 663,000 accounts (emails, profile details, some phone numbers). Passwords and cards were not taken. Expect phishing; don't act on unexpected messages.

QuickLens, a Chrome extension with about 7,000 users, turned malicious in version 5.8 after changing owners. Chrome reportedly disabled it. Remove it, scan for malware and reset exposed passwords; wallet users should seek help securing their funds.

Kaspersky found Keenadu, an Android backdoor built into some tablets' firmware and hidden in smart-camera apps (300,000+ downloads, now removed). Check your tablet maker for clean firmware, and don't use an infected device for banking or private messages.

AiFrame extensions exposed Chrome page content and Gmail text. Google removed the original set, but linked extensions appeared in April. Check extension IDs against the researchers’ lists, remove matches and reset passwords if affected.

An abandoned Outlook add-in, AgreeTo, was taken over and showed fake Microsoft logins inside Outlook; 4,000+ credential sets were stolen. Microsoft removed it. If you used it, uninstall it, change your Microsoft password and check bank and card statements.

Malicious OpenClaw add-ons used fake setup requirements to deliver password and wallet stealers on Macs and Windows PCs. ClawHub added screening and removed malicious listings. Review installed skills; get malware help if you ran their setup downloads.

German and Dutch authorities warned that fake 'Signal support' messages and booby-trapped QR codes are being used to hijack Signal and WhatsApp accounts of officials, military and journalists.

ZeroDayRAT is spyware sold on Telegram that claims to control Android and iPhones: camera, mic, location, texts and codes, plus bank and crypto theft. It needs you to install a fake app, usually from a text link. Don't install apps from links; use official stores only.