TLDR INFORMATION SECURITY 2026-02-17

Try Bitwarden Free Today

RESEARCHERS UNEARTH 30-YEAR-OLD VULNERABILITY IN LIBPNG LIBRARY

A heap buffer overflow (CVE-2026-25646, CVSS 8.3) in the libpng library, present since its inception nearly 30 years ago, has been patched in version 1.6.55. The flaw lies in the png_set_quantize function, which is used to reduce color in PNG images. Exploitation requires careful heap grooming and crafted-but-valid PNG files, potentially leading to crashes, information leakage, or remote code execution on unpatched systems that use the widely bundled Linux/Unix library. Although the rarely used vulnerable function lowers practical severity, security experts warn that AI-powered bug-hunting tools are accelerating the discovery of similar dormant vulnerabilities across open-source libraries, increasing the risk of threat-actor exploitation before coordinated disclosure.

LIGHTLLM: UNAUTHENTICATED RCE VIA PICKLE DESERIALIZATION IN WEBSOCKET ENDPOINTS

A critical unauthenticated RCE vulnerability (CVE-2026-26220, CVSS 9.3) has been revealed in LightLLM, a widely used LLM inference engine with 3,890 GitHub stars. The flaw involves WebSocket endpoints in the prefill-decode disaggregation system calling pickle.loads() on unauthenticated binary frames, and the server code explicitly disallows binding to localhost, exposing the server to network threats by design. This vulnerability mirrors CVE-2025-32444 (CVSS 10.0) in vLLM and underscores a broader issue of insecure deserialization across ML inference frameworks, as disaggregated serving architectures create additional attack surfaces between nodes. Organizations using LightLLM in PD mode should immediately restrict network access to WebSocket endpoints, as the maintainers have largely ignored security reports for nearly a year without providing a fix.

NEW CHROME ZERO-DAY (CVE-2026-2441) UNDER ACTIVE ATTACK — PATCH RELEASED

Google patched CVE-2026-2441 (CVSS 8.8), a use-after-free vulnerability in Chrome's CSS engine actively exploited in the wild, marking the first Chrome zero-day of 2026. The flaw allowed remote attackers to execute arbitrary code inside a sandbox via crafted HTML pages in versions prior to 145.0.7632.75. Users should immediately update Chrome on all platforms, and organizations using Chromium-based browsers such as Edge, Brave, Opera, and Vivaldi should apply fixes as they become available.

TRACKING DIGITSTEALER: HOW OPERATOR PATTERNS EXPOSED C2 INFRASTRUCTURE

An infrastructure analysis of DigitStealer, a macOS infostealer targeting 18 cryptocurrency wallets and Apple M2 devices, revealed that the operator's consistent use of a single Swedish ASN (ab stract ltd), Tucows domain registration, Njalla nameservers, and identical OpenSSH versions created a fingerprint that enabled clustering of previously unreported C2 domains. The malware operates as a persistent backdoor via Launch Agent, polling C2 endpoints every 10 seconds and using a cryptographic challenge-response mechanism for anti-analysis, while communicating over four distinct API endpoints for credential theft, file exfiltration, and command execution. The infrastructure uniformity strongly suggests a closed, single-operator campaign rather than a MaaS model — a reminder that when threat actors prioritize efficiency over operational security, defenders can exploit these patterns to proactively identify and burn C2 assets.

THE CISO'S CRAFT: WATCHMAKER OR GARDENER?

This post examines two distinct models of CISO leadership: the Watchmaker, which focuses on precision, strict controls, and auditability, and the Gardener, which promotes an adaptable security culture, team empowerment, and organizational resilience. The Watchmaker style works well in regulated settings but can lead to rigidity and burnout. In contrast, the Gardener encourages shared responsibility but depends on high organizational trust and long-term cultural commitment. The most successful CISOs combine elements of both—building strong foundational controls while fostering an adaptable security environment that evolves with emerging threats.

KEY OPENCLAW RISKS, CLAWDBOT, MOLTBOT

OpenClaw, previously known as Clawdbot, is a viral open-source AI assistant flagged as a major insider threat due to security flaws such as CVE-2026-25253 (CVSS score 8.8), insecure defaults (e.g., disabled authentication), plaintext secret storage, and a malicious skills ecosystem targeted by infostealers such as RedLine and AMOS. Its design includes privileged host access, exposure to untrusted data, and external communication capabilities. Organizations should detect OpenClaw through specific file paths, network signatures, and unusual OAuth activity, while reducing shadow AI risks with application allowlisting, least-privilege policies, isolated deployments, and transparent usage policies with staff training.

SEE HOW HAPROXY PROTECTED CUSTOMERS FROM REACT2SHELL.

AWS-CONFIG-D

aws-config-d splits the monolithic ~/.aws/config file into per-organization files under a config.d/ directory, automatically concatenating them via a shell hook on session start — useful for security teams and consultants managing SSO profiles across multiple AWS organizations. The tool includes SHA-256 drift detection that warns when external changes (such as aws configure sso) modify the config outside the managed workflow, preventing silent overwrites of carefully scoped access configurations. It supports bash, zsh, and fish with zero dependencies and ships with 42 containerized tests covering rebuild triggers, migration, and idempotency.

KASADA (PRODUCT LAUNCH)

Kasada is a cloud-based anti-bot security platform that protects websites, APIs, and mobile apps from malicious automated traffic such as scraping, credential stuffing, account takeover, and online fraud using adaptive, invisible bot detection instead of CAPTCHAs.

SANDBOXEXEC

A lightweight command sandbox for Linux, secure-by-default, built on Landlock. Use it to run risky commands with a tighter blast radius: third-party CLIs, untrusted scripts, generated code, and one-off tooling.

AMAZON SCRAPS PARTNERSHIP WITH SURVEILLANCE COMPANY AFTER SUPER BOWL AD BACKLASH

Ring has canceled a planned integration with Flock Safety after public backlash over a Super Bowl ad featuring AI-powered neighborhood tracking and broader concerns about a “dystopian” surveillance ecosystem. The integration never launched, so no customer footage was shared. The controversy amplified scrutiny of Ring's facial recognition features and Flock's vast license-plate tracking network amid mounting privacy and civil liberties criticism.

DUTCH COPS ARREST MAN AFTER SENDING HIM CONFIDENTIAL FILES BY MISTAKE

Dutch police accidentally gave a Ridderkerk man access to confidential documents by sending a download instead of an upload link, then arrested him for refusing to delete them without compensation. Officers seized his devices, reported a data breach, and charged him with unauthorized access.

260K+ CHROME USERS DUPED BY FAKE AI BROWSER EXTENSIONS

More than 30 lookalike Chrome extensions posing as AI assistants have siphoned email, browser data, and sensitive inputs from over 260,000 users, including corporate environments. Attackers embed a full-screen iframe that proxies real LLM APIs while exfiltrating content and API keys, evading Chrome Web Store review due to minimal local permissions and off-platform malicious logic.

MICROSOFT BLOCKS CREDENTIAL AUTOFILL TO FIX WINDOWS HELLO FLAW

Microsoft's February 2026 Patch Tuesday blocked credential autofill in Windows 11 remote desktop and screen-sharing tools to address CVE-2026-20804, a Windows Hello tampering flaw demonstrated at Black Hat 2025 that allowed attackers to inject biometric data and bypass authentication without detection.

SKILLAUDIT (WEB APP)

Paste a repo, and get an instant report on the vulnerabilities of the skill files.

OPERATION DOPPELBRAND WEAPONIZES TRUSTED BRANDS FOR CREDENTIAL THEFT

Operation DoppelBrand is a GS7-run phishing operation that abuses lookalike domains and cloned portals of major US banks, insurers, and tech firms to steal credentials and device data, then pipe them into Telegram for triage.