The Daily Index — Friday, February 20, 2026

ATTACKS & VULNERABILITIES

TLDR InfoSec

FRENCH GOVERNMENT SAYS 1.2 MILLION BANK ACCOUNTS EXPOSED IN BREACH

France's Ministry of Economy disclosed that attackers used stolen official credentials to access FICOBA, the national bank account registry, exposing data on 1.2 million accounts, including IBANs, names, addresses, and some tax IDs. Operational banking access and balances were not exposed, but authorities warn of heightened phishing and scams.

links.tldrnewsletter.com · 2 min

TLDR InfoSec

CRITICAL INFRA HONEYWELL CCTVS VULNERABLE TO AUTH BYPASS FLAW

CISA warned of CVE-2026-1670 (CVSS 9.8), a missing authentication flaw in multiple Honeywell CCTV models that allows unauthenticated attackers to remotely change the password recovery email address, enabling full account takeover and unauthorized access to camera feeds. Affected models include the I-HIB2PI-UL and several SMB NDAA-compliant PTZ cameras deployed in commercial and critical infrastructure environments. Organizations should isolate these devices behind firewalls, restrict network exposure, and contact Honeywell for patch guidance.

bleepingcomputer.com · 2 min

TLDR InfoSec

RED VULNS RISING: EXAMINING CHINESE NATIONAL VULNERABILITY DATABASES

Bitsight analyzed China's two national vulnerability databases—CNNVD, overseen by the Ministry of State Security, and CNVD, operated by CNCERT—and found that while they largely mirror CVE publication, approximately 1,400 entries were published in Chinese databases before becoming public in CVE, often by several months. China's 2021 RMSV regulations tightened domestic vulnerability disclosure controls, including mandatory 48-hour reporting to the government and prohibitions on sharing PoC exploits. There was a notable decline in non-CVE vulnerability publications from CNVD after the regulation, although CNNVD has recently seen a resurgence. Security leaders should account for potential blind spots in Western vulnerability ecosystems, as some Chinese database entries lack CVE equivalents and may represent vulnerabilities unknown to Western defenders.

bitsight.com · 18 min

TLDR InfoSec

CLINEJECTION — COMPROMISING CLINE'S PRODUCTION RELEASES JUST BY PROMPTING AN ISSUE TRIAGER

A prompt-injected GitHub issue title could drive Cline's Claude-based triage bot to execute arbitrary commands in CI, then use GitHub Actions cache poisoning to hijack nightly build workflows and steal VS Code Marketplace, OpenVSX, and npm publishing tokens. This chain could have enabled a massive supply-chain attack on millions of developers via malicious extension or CLI updates.

adnanthekhan.com · 13 min

TLDR InfoSec

DECRYPTING MULTIDESK PASSWORDS

MultiDesk RDP client's password encryption was reverse-engineered, revealing RC4 encryption with per-user keys stored in the HKEY_CURRENT_USER\Software\MultiDesk\key registry hive across both legacy (v3.16) and modern (v14.0) versions. Version 3.16 used base64-encoded RC4 ciphertext with rdtsc-generated keys, while version 5+ introduced a salted key derivation scheme using CryptGenRandom, but remained fundamentally RC4-based. Pentesters should add MultiDesk.xml, MultiDesk.multidesk, and the associated registry keys to their internal recon checklists, as credential recovery is trivial with local admin or user-level access to the target machine.

blog.paradoxis.nl · 13 min

TLDR InfoSec

VENICE SECURITY (PRODUCT LAUNCH)

Venice Security provides an adaptive privileged access management platform that discovers identities and entitlements across cloud, on‑prem, and SaaS, grants just‑in‑time access only when needed, and automatically revokes standing privileges to reduce enterprise risk.

venice.io

TLDR InfoSec

CITIZEN LAB FINDS CELLEBRITE TOOL USED ON KENYAN ACTIVIST'S PHONE IN POLICE CUSTODY

Citizen Lab confirmed with high confidence that Cellebrite forensic extraction tools were used on Kenyan pro-democracy activist Boniface Mwangi's Samsung phone while in police custody following his July 2025 arrest, potentially enabling full data extraction including messages, passwords, and financial information. The findings follow a similar report of Cellebrite misuse in Jordan and coincide with Amnesty International's discovery of Intellexa's Predator spyware targeting an Angolan journalist via WhatsApp, marking the first confirmed Predator case against civil society in Angola. The cases highlight the growing global abuse of commercial surveillance tools against activists and journalists, with Predator's sophisticated anti-forensics capabilities including crash monitoring, recording indicator suppression, and granular operator control over failed deployments.

thehackernews.com · 3 min

TLDR InfoSec

INTERPOL OPERATION RED CARD 2.0 ARRESTS 651 IN AFRICAN CYBERCRIME CRACKDOWN

An INTERPOL-led push across 16 African countries led to 651 arrests, $4.3 million recovered, and disruption of online scams causing over $45 million in losses. Authorities dismantled high-yield investment, mobile money, and fake loan schemes, seizing 2,341 devices and taking down 1,442 malicious IPs and domains, with victims identified both in Africa and abroad.

thehackernews.com · 2 min

TLDR InfoSec

KEEPING GOOGLE PLAY & ANDROID APP ECOSYSTEMS SAFE IN 2025

Google reported blocking over 1.75 million policy-violating apps and banning 80,000 malicious developer accounts from Google Play in 2025, while Play Protect's real-time scanning identified more than 27 million new malicious apps from outside the store across 350 billion daily scans. Enhanced fraud protection expanded to 185 markets covering 2.8 billion devices, blocking 266 million risky sideloaded installation attempts. New defenses included in-call scam protection preventing users from being socially engineered into disabling Play Protect, and Android 16's one-line-of-code tapjacking protection for sensitive app screens.

security.googleblog.com · 6 min

TLDR InfoSec

FIREBASE MISCONFIGURATION EXPOSES 300M MESSAGES FROM CHAT & ASK AI USERS

A misconfigured Firebase database exposed approximately 300 million chat messages from 25 million users of Codeway's Chat & Ask AI app.

hackread.com · 3 min

TLDR InfoSec

GERMANY'S NATIONAL RAIL OPERATOR DEUTSCHE BAHN HIT BY A DDOS ATTACK

A large-scale DDoS attack hit Deutsche Bahn on 17–18 February, knocking out bahn.de, the DB Navigator app, and core IT systems.

securityaffairs.com · 2 min

TLDR InfoSec

STATE DEPT. OFFICIAL SAYS POST-QUANTUM TRANSITION PLANS WILL OUTLIVE CURRENT LEADERSHIP

State Department official Gharun Lacy urged public and private sectors to coordinate post-quantum cryptography transitions as a collective ecosystem effort, warning that data harvesting threats from nation-state adversaries like China will outlive leadership cycles and require sustained cross-generational commitment toward the 2035 migration target.

cyberscoop.com · 1 min