SOCshare: cybersecurity landscape in February 2026

SOCshare: cybersecurity landscape in February 2026

From repurposed digital forensics tools to vulnerable AI agents, the month was a masterclass in weakening confidence in our cyber safety.

More about SOCshare

Microsoft’s Patch Tuesday

February delivered one of the most intense Patch Tuesdays, addressing 59 vulnerabilities, including six actively exploited zero-day vulnerabilities. Three out of six zero-days heavily targeted the client-side attack surface through social engineering. Flaws in the Windows Shell (CVE-2026-21510) and MSHTML Framework (CVE-2026-21513) allowed attackers to bypass SmartScreen and other security prompts simply by convincing users to open malicious .lnk or HTML files. A separate bypass in Microsoft Word (CVE-2026-21514) allowed attackers to evade OLE mitigations using crafted Office documents. It’s a reminder that phishing remains as dangerous as ever.

SolarWinds WHD and The Velociraptor

The widespread exploitation of SolarWinds Web Help Desk (exploiting CVE-2025-26399, CVE-2025-40536, and CVE-2025-40551) servers has come to light. But the real story wasn’t the initial access – it was the post-compromise tradecraft. Rather than deploying custom malware, the threat actor utilized Velociraptor, a well-known, open-source digital forensics and incident response (DFIR) tool. By turning a trusted security tool into a Command and Control (C2) framework, the attackers effectively blinded defenders, using Velociraptor to disable Microsoft Defender, stage files, and run commands.

What else happened in February 2026?

Autonomous AI risk

OpenClaw, a very popular open-source autonomous AI assistant, suffered from a critical vulnerability (CVE-2026-25253) that allowed for one-click remote code execution. The attack works by exploiting OpenClaw's failure to validate the WebSocket origin header, meaning its server accepts connections from any website. A victim simply visiting a malicious web page is enough - the attacker's JavaScript retrieves an authentication token, establishes a WebSocket connection, and using the token logs in to the victim's OpenClaw instance, and from there, execute commands on the device.

Substack's Data Breach

The newsletter platform Substack confirmed a data breach exposing the personal information of around 700,000 users. While passwords and financial data were not stolen, the leak included email addresses, phone numbers, and, although not confirmed, Stripe system customer IDs. The breach occurred in October 2025, but the company didn't detect the breach until early February 2026, leaving creators and subscribers exposed to targeted phishing campaigns.

Where to pay attention to

Organisations should prioritise:

Monitor security tooling install and use: Establish strict policies and monitor the behavior of security tools. Threat actors, on occasion, install and use tools like Velociraptor or EDR/XDR solutions to control devices, which often goes unnoticed, because most people consider them inherently safe.

Isolate Agentic AI: Tools like OpenClaw with code execution and high-level credentials have inherent risks. If your developers or employees are running AI agents, these must be treated as untrusted entities. They should only operate in strictly isolated environments (like sandboxed VMs) with dedicated, non-privileged credentials.

Audit your update channels: Move toward centralized software repositories (for example, use Microsoft Intune, Microsoft SCCM, or a similar solution) for deployments rather than allowing endpoints to query external update servers directly.

Sources:

CrowdStrike – February 2026 Patch Tuesday: Six Zero-Days Among 59 CVEs Patched
Huntress – Active Exploitation of SolarWinds Web Help Desk
The Hacker News – OpenClaw Bug Enables One-Click Remote Code Execution via Malicious Link
CSO – Substack data breach leaks users’ email addresses and phone numbers

This entry is published as part of the SOCshare project (No. 101145843), which we are running together with Vilnius City Municipality. It is partly funded by the European Union. The views and opinions expressed are those of the authors alone and do not necessarily reflect those of the European Union or the European Cyber Security Centre of Excellence. Neither the European Union nor the European Cyber Security Centre of Excellence can be held responsible for them.