• SolarWinds Web Help Desk exploitation observed in the wild, attackers abused WHD RCE to gain access and then used dual use tooling for persistence and follow on actions, including tunneling and remote management tools in multiple reports. Source: https://thehackernews.com/2026/02/solarwinds-web-help-desk-exploited-for.html
• Additional operational details indicate WHD exploitation campaigns focused on credential access and server footholds, with attacker tradecraft leaning on legitimate tools to reduce malware footprint. Source: https://www.csoonline.com/article/4130151/solarwinds-whd-zero-days-from-january-are-under-attack.html
• Conduent breach reporting expanded again, public reporting indicates a much larger affected population than earlier disclosures, with government services and benefits administration exposure risk (PII including SSNs reported by multiple outlets). Source: https://techcrunch.com/2026/02/05/data-breach-at-govtech-giant-conduent-balloons-affecting-millions-more-americans/
• Conduent breach impacts extended to enterprise customers, reporting includes Volvo Group North America employee data exposure via the same provider compromise timeline. Source: https://www.theregister.com/2026/02/10/conduent_volvo_breach/
• Apple patched an exploited zero day in dyld (CVE-2026-20700), described by Apple as used in an extremely sophisticated targeted attack, defenders should treat Apple endpoints as potentially in scope for post exploitation investigation if prior versions were present. Source: https://support.apple.com/en-us/126346

• Microsoft February 2026 Patch Tuesday includes multiple in the wild zero days and a large set of fixes, prioritize endpoint and Office update deployment for actively exploited items, and validate coverage for developer tooling and cloud services where applicable. Source: https://www.tenable.com/blog/microsofts-february-2026-patch-tuesday-addresses-54-cves-cve-2026-21510-cve-2026-21513
• Apple released coordinated platform updates (iOS 26.3 family) fixing the exploited dyld issue, confirm fleet compliance on iOS, macOS, watchOS, tvOS, visionOS where applicable. Source: https://nvd.nist.gov/vuln/detail/CVE-2026-20700
• Palo Alto Networks published February advisories including Chromium monthly updates for Prisma Browser and PAN OS issue notes, ensure advisory mapping to your deployed trains and managed update rings. Source: https://security.paloaltonetworks.com/PAN-SA-2026-0002
• Cisco updated its Unified Communications critical RCE advisory (CVE-2026-20045) on February 13, 2026, verify you are on fixed releases and confirm any compensating controls for exposed management interfaces. Source: https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-voice-rce-mORhqY4b
• Fortinet FortiClientEMS critical SQL injection (CVE-2026-21643) patch guidance published and widely tracked, prioritize internet exposed management surfaces and validate WAF or access control boundaries. Source: https://fortiguard.fortinet.com/psirt/FG-IR-25-1142

• Reuters reporting on heightened US Iran operational posture increases likelihood of retaliatory cyber activity and hacktivist spillover across US aligned sectors, raise monitoring for Iran aligned intrusion sets and destructive or disruption oriented TTPs. Source: https://www.reuters.com/world/middle-east/us-military-preparing-potentially-weeks-long-iran-operations-2026-02-13/
• Norwegian threat assessment reporting flags Russian and Chinese intelligence focus on maritime infrastructure, relevant to port operators, shipping logistics, and OT connected environments. Source: https://maritime-executive.com/article/norway-flags-russian-cyber-espionage-campaign-on-maritime-infrastructure
• Reporting based on Google observations indicates sustained cyber pressure on defense industrial base from Russia and China linked activity, reinforce supplier access controls and segmented remote support pathways. Source: https://industrialcyber.co/reports/google-flags-sustained-cyber-pressure-on-defense-industrial-base-from-russia-china-linked-actors/

• CVE-2026-20700 (Apple dyld) exploited in targeted attacks, patch across Apple platforms and treat older iOS and macOS versions as potentially at risk for code execution. Source: https://support.apple.com/en-us/126346
• CVE-2025-40551 and related SolarWinds WHD issues, exploitation and post exploitation tradecraft documented, patch to WHD 2026.1 and review telemetry for web shell like behavior, tunneling, and unusual service creation. Source: https://www.solarwinds.com/trust-center/security-advisories
• SolarWinds WHD 2026.1 release notes list multiple critical CVEs and scoring, use this as authoritative patch baseline for change management and vulnerability exceptions. Source: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
• Microsoft actively exploited fixes and prioritization guidance summarized by independent research, ensure you prioritize in the wild items in your patch SLA. Source: https://krebsonsecurity.com/2026/02/patch-tuesday-february-2026-edition/
• BeyondTrust RS and PRA OS command injection (CVE-2026-1731) added to KEV reporting by multiple outlets, treat privileged access tooling as high value and review external exposure. Source: https://securityaffairs.com/187982/uncategorized/u-s-cisa-adds-a-flaw-in-beyondtrust-rs-and-pra-to-its-known-exploited-vulnerabilities-catalog.html

• Multiple reports on SolarWinds WHD exploitation show attackers prioritizing stealthy persistence using legitimate remote management, tunneling, and IR tooling, aligns to hands on keyboard intrusion patterns where attribution may be fluid across criminal and state aligned operators. Source: https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/
• China linked Lotus Blossom infrastructure notes updated by Unit 42, includes supply chain style tradecraft and backdoor enabling remote control, treat developer workstation and software distribution paths as high risk where older updater logic exists. Source: https://unit42.paloaltonetworks.com/notepad-infrastructure-compromise/
• Cobalt Strike and Sliver C2 infrastructure continues to surface in open telemetry, validate detections for common beaconing patterns and egress to commodity hosting and VPS ranges. Source: https://threatfox.abuse.ch/browse.php?search=malware%3ACobaltStrike

• 70.39.197.162:1080 (Cobalt Strike, C2 beaconing)
• 47.109.45.70:12345 (Cobalt Strike, C2 infrastructure)
• 95.213.143.102:443 (Earth Baxia, Cobalt Strike C2)
• 195.177.94.132:31337 (Sliver, C2 listener)
• 181.174.165.128:3333 (GoPhish, phishing infrastructure)
• 97b3d06cabef1e153541fdba3a6f55a4 (Vidar, infostealer payload)
• 587ea69283a5e2863add67c8d8ad0382910bdb57d1fd52882ad6df7531dc6a5e (Coinminer, payload execution)

• SolarWinds WHD exploitation is a priority because it provides direct remote code execution and documented lateral movement pathways, treat exposed WHD as incident candidates, not just patch candidates. Source: https://www.elastic.co/security-labs/solarwinds-whd-exploitation
• Apple exploited zero day language suggests targeted operations, organizations with high risk users should validate MDM posture, rapid update compliance, and investigate anomalous dyld related crash patterns or suspicious process injection indicators on older builds. Source: https://www.helpnetsecurity.com/2026/02/12/apple-zero-day-fixed-cve-2026-20700/
• Microsoft patch cycle includes multiple in the wild items, align vulnerability management with active exploitation signals, not just CVSS, and confirm zero day remediations reached endpoints used by admins and developers. Source: https://www.thezdi.com/blog/2026/2/10/the-february-2026-security-update-review

• Conduent breach reporting suggests significant US PII exposure and downstream fraud risk for residents interacting with state services, elevate monitoring for identity based fraud, phishing, and social engineering targeting benefits recipients and administrators. Source: https://finance.yahoo.com/news/conduent-data-breach-exposed-25-210631162.html
• Privileged access and remote support tooling in KEV reporting (BeyondTrust CVE-2026-1731) indicates real world exploitation patterns that often precede ransomware and data theft, confirm external access constraints, MFA enforcement, and logging retention for these platforms. Source: https://securityaffairs.com/187982/uncategorized/u-s-cisa-adds-a-flaw-in-beyondtrust-rs-and-pra-to-its-known-exploited-vulnerabilities-catalog.html
• Active exploitation of SolarWinds WHD is relevant to US enterprises and public sector because WHD is common in IT service management footprints, prioritize scanning for exposed WHD and evidence of exploitation. Source: https://www.cybersecuritydive.com/news/threat-actors-target-solarwinds-web-help-desk-flaw/811702/

• GitHub community continues rapid aggregation of public PoCs, watch for weaponization signals by correlating newly added PoCs with your external attack surface, and apply additional monitoring where exploit maturity rises. Source: https://github.com/nomi-sec/PoC-in-GitHub
• GitHub based CVE PoC indexing remains a common workflow input for defenders and attackers alike, use this to anticipate scanning bursts after PoC publication. Source: https://github.com/trickest/cve
• On X, community discussion amplified PAN OS CVE-2026-0229 reboot and maintenance mode risk, use social signals only as triage hints, confirm with vendor advisories before action. Source: https://x.com/The_Cyber_News/status/2022134339006595471

• Moderate Confidence, open source telemetry continues to surface new GoPhish and Sliver endpoints, these often reflect lab setups and real campaigns, prioritize correlation with your own detections and blocklists rather than blind blocking. Source: https://threatfox.abuse.ch/browse/
• Moderate Confidence, third party writeups claim attacker preference for dual use tools in WHD exploitation chains, while consistent with multiple reports, validate in your environment via process lineage and network egress baselining. Source: https://www.techradar.com/pro/security/solarwinds-whd-flaws-exploited-in-attacks-targeting-servers-and-credentials

• SolarWinds WHD exploitation, patch and hunt for dual use persistence and lateral movement activity. Source: https://thehackernews.com/2026/02/solarwinds-web-help-desk-exploited-for.html
• Apple dyld exploited zero day, verify rapid uptake of iOS 26.3 family updates. Source: https://support.apple.com/en-us/126346
• Microsoft in the wild Patch Tuesday items, enforce expedited patching for endpoints with Office and admin tooling. Source: https://www.tenable.com/blog/microsofts-february-2026-patch-tuesday-addresses-54-cves-cve-2026-21510-cve-2026-21513

• Identify and remediate any internet exposed WHD, and review logs for suspicious AjaxProxy activity and follow on tooling. Source: https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm
• Enforce fleet wide Apple update compliance and prioritize high risk user devices for validation and triage. Source: https://www.helpnetsecurity.com/2026/02/12/apple-zero-day-fixed-cve-2026-20700/
• Add listed IOCs to detection pipelines and correlate with internal telemetry before blocking at scale to avoid false positives, especially for moderate confidence infrastructure. Source: https://threatfox.abuse.ch/browse/

• Reduce exposure of privileged access and remote support tooling, ensure MFA, least privilege, and long retention audit logs, prioritize remediation for KEV listed items. Source: https://securityaffairs.com/187982/uncategorized/u-s-cisa-adds-a-flaw-in-beyondtrust-rs-and-pra-to-its-known-exploited-vulnerabilities-catalog.html
• Strengthen supply chain and updater trust controls, validate code signing and update integrity paths for widely deployed utilities and developer tools. Source: https://unit42.paloaltonetworks.com/notepad-infrastructure-compromise/