Zurück zur Übersicht

TECHFIXBK BLOG

Microsoft February 2026 Alert: 6 Zero-Days Exploited

M

Microsoft February 2026 Alert: 6 Zero-Days Exploited

TechFixBK
||29 min read

Hook & Who This Is For (Intro)

The February 2026 update cycle has introduced a critical urgency for system administrators and home users alike. With 58 flaws addressed, the most alarming discovery is the presence of 6 zero-day vulnerabilities that are currently being actively exploited in the wild [13].

Security researchers have observed nation-state actors, such as APT28, weaponizing these vulnerabilities with extreme speed, sometimes within 48 hours of a patch being released [3][14]. This report breaks down the risks and identifies exactly which systems require immediate attention to prevent unauthorized access and data breaches.

Who This Information Is For

This guide is designed for individuals and organizations who rely on the Microsoft ecosystem for daily operations. It is particularly relevant for:

  • IT Administrators managing on-premises Exchange Server environments, specifically versions 2016, 2019, or the Subscription Edition (SE) [9].
  • Security Professionals monitoring networks for specialized sectors, including diplomatic, maritime, and transportation organizations, which have been primary targets for recent campaigns [3][14].
  • Desktop Users and small business owners running Microsoft Office or Windows 11 who need to understand the impact of the latest Critical elevation of privilege flaws [13].
  • Technical Stakeholders participating in Operation Winter SHIELD, an FBI-led initiative focusing on the implementation of security controls to mitigate these repeatable failure patterns [12].

Who May Not Need This Update Immediately

While maintaining an up-to-date system is always recommended, certain users may be less affected by this specific February alert:

  • Exchange Online customers, as Microsoft has confirmed these users are already protected from the latest server-side vulnerabilities and do not need to take action for their cloud mailboxes [9][11].
  • Users of non-Windows operating systems (e.g., macOS, Linux) who do not have Microsoft Office or other Microsoft-specific components installed.
  • Organizations that have already transitioned away from legacy or end-of-life infrastructure that no longer receives security updates [12].

TL;DR / What This Means for You

As of February 10, 2026, the security landscape is dominated by the fallout from Microsoft’s January 2026 update cycle and the continued active exploitation of third-party vulnerabilities. Security researchers have identified multiple vulnerabilities being used in live attacks, requiring immediate administrative attention to prevent unauthorized system access [7][15].

Key Insights

  • Active Exploitation Confirmed: High-profile vulnerabilities in SolarWinds Web Help Desk (WHD) and Microsoft Edge (Chromium-based) are currently being exploited "in the wild" to facilitate remote code execution and credential theft [7][15].
  • Critical Infrastructure Risk: Recent patches address 112 vulnerabilities across essential services, including SQL Server, Windows Kernel, and Windows Hello [1][9].
  • Advanced Attack Vectors: Threat actors are using sophisticated techniques such as DLL sideloading via wab.exe and DCSync attacks to compromise domain controllers and steal high-privilege credentials [7][8].

Main Recommended Actions

  • Prioritize Patching: Immediately apply the January/February 2026 security updates for Windows Server 2025, Windows 11, and Microsoft Edge to mitigate known exploit paths [2][15].
  • Harden Authentication: Disable NTLM authentication on workstations and the Remote Registry service where possible to block lateral movement and credential relay attacks [10].
  • Audit Third-Party Software: Update SolarWinds WHD instances to version 2026.1 or later and rotate all service credentials associated with the application [7][9].

Risk Note: While updates minimize exposure, they do not provide absolute security against novel attack variants. Failure to rotate credentials after a suspected exploitation of CVE-2025-40551 or CVE-2025-40536 may leave systems vulnerable even after software patches are applied [7].

Background / Basics

To understand the severity of the February 2026 security updates, it is important to first define how these releases function and the specific terminology used by vendors like Microsoft.

What is Patch Tuesday?

Every second Tuesday of the month, Microsoft releases a scheduled set of security updates, commonly referred to as Patch Tuesday [2][10]. These updates are designed to address vulnerabilities—flaws in software code that could potentially be exploited by unauthorized users—across the Windows operating system and related software like Microsoft Office and SQL Server [1][9][10].

Understanding "Zero-Day" Vulnerabilities

The February 2026 release is particularly significant because it addresses six zero-day vulnerabilities [2][10]. According to Microsoft's classification, a zero-day is a flaw that is either publicly disclosed or actively exploited in the wild before an official fix or "patch" is made available to the public [10][19].

Because these flaws are known to attackers before defenders have a solution, they typically represent a higher risk than standard vulnerabilities.

The Current Security Landscape

The security environment leading into February 2026 has been characterized by high activity and several overlapping initiatives:

  • Patch Volume: The January 2026 update was notably large, consisting of 112 Microsoft CVEs (Common Vulnerabilities and Exposures) [1][9].
  • Active Threats: In late January 2026, Microsoft released an urgent, unscheduled update for a critical Office vulnerability (CVE-2026-21509) that was being exploited by state-sponsored threat groups like APT28 [6].
  • Operation Winter SHIELD: A nine-week cybersecurity initiative led by the FBI Cyber Division began on February 2, 2026 [13]. This collaborative effort focuses on the practical implementation of security controls to close the "gap" between known risks and active enforcement [13][15].

Key Vulnerability Categories

The February 10, 2026 update addresses a total of 58 flaws [2][10]. These are categorized by the type of risk they pose to a system:

Category Count Description
Elevation of Privilege 25 Allows an attacker to gain higher permissions (e.g., Administrator) [10].
Remote Code Execution (RCE) 12 Enables an attacker to run arbitrary code on a target device [10].
Information Disclosure 6 Allows unauthorized access to sensitive data [10].
Security Feature Bypass 5 Permits an attacker to circumvent existing security protections like SmartScreen [10][19].
Spoofing & Others 10 Includes vulnerabilities related to identity theft or service disruption [10].

This update also begins a phased rollout of new Secure Boot certificates to replace original 2011 certificates that are expected to expire in late June 2026 [10].

Problem Explanation (What's Going On?)

The cybersecurity landscape in early 2026 is currently defined by a surge in targeted attacks against newly disclosed vulnerabilities. Reports indicate that state-sponsored actors, specifically from Russia, have actively targeted organizations immediately following the release of urgent Microsoft Office patches [13]. This trend of "pouncing" on vulnerabilities as soon as they are disclosed has significantly shortened the window for defenders to secure their environments [5].

In January 2026 alone, Microsoft released updates for 112 CVEs, covering critical components such as SQL Server 2025, Windows Kernel, Microsoft Office, and Hyper-V [2][9][11]. Despite the availability of these patches, many organizations remain vulnerable. Investigative data suggests this is often due to incomplete or inconsistently enforced security controls rather than a lack of technical guidance [12].

Active Exploitation Patterns

Current investigative insights reveal that threat actors are not just discovering new vulnerabilities but are systematically exploiting "repeatable failures" [5]. These failures often involve legacy paths that remain open or misconfigurations that were understood but never addressed [12]. Common symptoms of active exploitation observed in recent incidents include:

  • Credential Theft: Attackers are abusing domain replication (DCSync) and sensitive services like LSASS to steal identities and escalate privileges [15].
  • Persistent Access: The use of reverse SSH shells and SSH tunneling has been observed, allowing attackers to maintain a foothold within a network [15].
  • Payload Execution: Compromised devices have been seen spawning PowerShell to download malicious payloads via BITS [15].
  • DLL Sideloading: Attackers are abusing legitimate system files, such as wab.exe, to load malicious .dll files and bypass detection [15].

The Impact of the "Implementation Gap"

The FBI’s Cyber Division reports that manageable security events are frequently escalating into prolonged crises because basic controls are not fully operationalized [12]. While guidance exists, the complexity of modern environments—comprising various cloud services, applications, and devices—makes consistent deployment difficult [5].

Affected Component Potential Impact
Microsoft Office Targeted by state-sponsored actors for initial access and data theft [13].
SQL Server 2025 Risk of unauthorized data access if January updates are not applied [11].
Windows SMB/NTFS Potential for lateral movement and unauthorized file system manipulation [4][8].
Windows Kernel Risks involving privilege escalation and deep system compromise [2][8].

This gap between possessing a security product and actually enforcing its controls is what allows ransomware operations and nation-state actors to succeed [12]. Analysts suggest that the margin for error is now smaller than ever, as attack chains often move faster than defenders can meaningfully intervene [5].

Root Causes / Analysis (Why Is This Happening?)

The current security landscape is shaped by a combination of sophisticated exploit techniques and systemic configuration weaknesses. Analysis suggests that threat actors are increasingly targeting gaps between the release of a security patch and its actual implementation within an organization [3][14].

Confirmed Causes

Exploitation of Specific Software Vulnerabilities Evidence confirms that threat actors have actively exploited critical vulnerabilities in SolarWinds Web Help Desk (WHD) [7][11]. These include CVE-2025-40551, which involves untrusted data deserialization, and CVE-2025-40536, a security control bypass [1][11]. These flaws allowed unauthenticated Remote Code Execution (RCE) on internet-facing servers [7][11].

Abuse of Legitimate Administrative Tools Attackers frequently leverage "living-off-the-land" techniques by using legitimate software for malicious purposes [4][11]. In recent campaigns, the Background Intelligent Transfer Service (BITS) was used for payload delivery, and the Zoho ManageEngine RMM tool was installed to provide interactive control over compromised systems [4][11].

Credential Theft and Identity Exploitation Confirmed reports show that threat actors utilize DLL sideloading by abusing wab.exe to load malicious files like sspicli.dll [2][7]. This method allows access to LSASS memory, enabling credential theft while bypassing traditional detection patterns [2][4]. Furthermore, activity often escalates to DCSync attacks to request password data directly from domain controllers [2][4].

Hypotheses and Analysis

The Security Implementation Gap There appears to be a significant "implementation gap" where the speed of threat actor evolution outpaces the consistent enforcement of security controls [3][14]. While the controls to reduce risk remain stable, the time it takes for organizations to move from "intention" to "enforcement" creates a window of opportunity for exploitation [14].

Persistence of Insecure Legacy Protocols Analysts suggest that the continued use of outdated protocols like NTLM on Windows workstations significantly increases the attack surface [1][15]. Because NTLM is susceptible to Pass-the-Hash and relay attacks, its presence in modern environments likely facilitates lateral movement for attackers who have gained an initial foothold [15].

Inadvertent Configuration Errors Recent infrastructure instability, such as the Azure virtual machine extension outage, was traced back to a configuration change that unintentionally restricted access to managed storage accounts [12][28]. It is hypothesized that similar unintended changes in complex cloud environments can create temporary security blind spots or service dependencies that attackers might exploit [12].

Factor Type Impact
CVE-2025-40551 Confirmed Unauthenticated RCE [7]
DLL Sideloading Confirmed Credential theft via LSASS [2]
NTLM Protocol Analysis Increased risk of lateral movement [15]
BITS Abuse Confirmed Stealthy payload delivery [4]

Warning: Attackers are currently observed using QEMU virtual machines to hide malicious activity within virtualized environments on compromised hosts [11].

Evidence & Reality Check

Official documentation and collaborative reports from early 2026 confirm a heightened threat landscape that prioritizes the exploitation of existing security gaps. Data from the Microsoft Security Response Center (MSRC) and the FBI Cyber Division indicate that threat actors are moving away from complex new methods and instead focusing on repeatable failures in organizational defenses [3][6].

Official Vulnerability Data

The January 2026 security release addressed a significant number of vulnerabilities across the Windows ecosystem and Microsoft Office suite [5][7]. Technical logs confirm that these updates are cumulative, meaning they include all previous security fixes to ensure comprehensive protection [3].

Product Category Affected Components (Examples) Documentation Source
Windows Server Windows Server 2025, 2022, 23H2 [5][15]
Windows Client Windows 11 versions 24H2 and 25H2 [5][7]
Database SQL Server 2025 GDR [13]
Productivity Microsoft Office (Word, Excel, SharePoint) [7][15]

Operation Winter SHIELD Reports

Evidence from Operation Winter SHIELD, a nine-week initiative led by the FBI Cyber Division beginning February 2, 2026, highlights that the primary risk to organizations is the "implementation gap" [6]. Investigative experience from the FBI and Microsoft Incident Response shows that incidents rarely occur because of a lack of guidance [6][14]. Instead, they stem from controls that are incomplete or inconsistently enforced [3][6].

According to official investigative insights, several patterns of failure have been confirmed in recent incidents:

  • Legacy Infrastructure: Nation-sponsored actors frequently exploit end-of-life systems that no longer receive security updates [6].
  • Lateral Movement: Ransomware operations typically use over-privileged accounts and weak authentication to move through networks [6].
  • Misconfigurations: Criminal groups capitalize on known security flaws that were identified but never fully addressed by administrators [6][14].

The 2026 Global Online Safety Survey corroborates that while users feel more connected, they perceive the digital environment as less safe [8]. Research involving over 130,000 interviews across 37 countries indicates that exposure to risks like scams and hate speech has risen [8]. Furthermore, industry analysts at IDC MarketScape have recognized the growing necessity for unified AI Governance Platforms as organizations struggle to make emerging technologies enterprise-ready and safe [2].

Reality Check: Confirmed vs. Speculative

It is confirmed that the FBI and Microsoft are actively monitoring high-impact control areas to narrow the margin for error available to attackers [14]. While official reports confirm the existence of widespread exploitation, it is likely that the full scale of the February zero-day impact may not be fully realized until the conclusion of Operation Winter SHIELD in April 2026. Experts suggest that the speed and reliability of control implementation remain the most critical factors in determining security outcomes [3][6].

Self-Check / Diagnosis

To determine if your environment is vulnerable to the exploits identified in the February 2026 security cycle, follow these diagnostic steps. These steps focus on identifying vulnerable software versions and searching for indicators of active exploitation.

1. Verify Software Versions and Patch Levels

Check if your systems are running the specific versions of software targeted in recent campaigns. Key products requiring verification include:

  • SolarWinds Web Help Desk (WHD): Determine if your installation is missing patches for CVE-2025-40551, CVE-2025-40536, or CVE-2025-26399 [1][10].
  • SQL Server 2025: Confirm if Security Update KB5073177 has been applied to your SQL Server 2025 GDR instances [5][11].
  • Windows Operating Systems: Check for the installation of recent cumulative updates such as KB5073455 for Windows 11 or KB5073379 for Windows Server 2025 [6][9].
  • Exchange Server: Use the Exchange Server Health Checker script to identify if your servers are behind on security updates (SUs) or cumulative updates (CUs) [12].

2. Audit for Suspicious Process Activity

In environments running SolarWinds WHD, search for unauthorized process executions that may indicate post-exploitation activity. Analysts have observed the application spawning PowerShell to leverage BITS for payload delivery [4][10].

Specifically, monitor for any instances of java.exe or tomcat initiating commands such as whoami, net user, certutil, or curl within the \WebHelpDesk\bin\ directory [1]. The presence of ToolsIQ.exe is also a significant indicator of unauthorized remote monitoring and management (RMM) tools [2].

3. Inspect for Persistence and Evasion Mechanisms

Threat actors have been observed using sophisticated methods to maintain access. Review your systems for the following anomalies:

Indicator Type Description Technical Detail
Scheduled Tasks Unauthorized tasks designed to run at startup. Search for a task named TPMProfiler [2][10].
DLL Sideloading Abuse of legitimate executables to load malicious files. Check if wab.exe is loading a suspicious sspicli.dll [2][4].
Virtualization Hidden activity within virtual machines. Look for qemu-system-x86_64.exe running under the SYSTEM account [2][10].
Credential Abuse Unauthorized domain replication. Monitor for DCSync activity or anomalous access to the LSASS service [2][4].

4. Scan for Specific Exploitation Artifacts

Manually or programmatically check for files and network configurations associated with known attacks. This includes searching for the file path C:\Users\ \tmp\qemu-system-x86_64.exe or checking for unexpected SSH tunneling and Reverse SSH shells [2][4].

For Microsoft Outlook users, be aware that certain exploits may disable macro security controls or create custom email properties like AlreadyForwarded to hide forwarded messages [13]. If these indicators are found, it may suggest that an adversary like APT28 has targeted the system [13].

5. Utilize Automated Vulnerability Management

If you use Microsoft Defender Vulnerability Management (MDVM), check the dashboard for devices flagged as potentially impacted by CVE-2025-40551 or CVE-2025-40536 [4]. Security teams can also run Kusto Query Language (KQL) queries in Microsoft Defender XDR to proactively hunt for suspicious commands originating from the wrapper.exe parent process [1][4].

Solutions / What to Do

To mitigate the risks associated with the February 2026 security alerts and ongoing exploitation, technical teams should prioritize a tiered response strategy. This involves immediate remediation of known vulnerabilities followed by the adoption of hardened security baselines [3][5].

Short-Term Response: Immediate Actions

The most critical step is addressing the active exploitation of SolarWinds Web Help Desk (WHD) and the vulnerabilities identified in the January 2026 update cycle.

  • Apply Critical Patches: Update SolarWinds WHD to address CVE-2025-40551, CVE-2025-40536, and CVE-2025-26399 immediately [3][14]. For database environments, ensure SQL Server 2025 is updated to version 17.0.1050.2 to resolve the CVE-2026-20803 elevation of privilege vulnerability [6][11].
  • Restrict Access: Remove public internet access to administrative paths on Web Help Desk instances [3][14]. Analysis suggests that restricting these paths can significantly reduce the attack surface for remote code execution attempts [3][7].
  • Evict Unauthorized Tools: Scan for and remove unauthorized Remote Monitoring and Management (RMM) artifacts, specifically ToolsIQ.exe, which have been observed in post-exploitation activity [3][14].
  • Credential Rotation: Rotate all service and administrator account credentials that are reachable from potentially compromised web-facing applications [3][14].
  • Increase Monitoring: Enable enhanced logging on Ajax Proxy and use Microsoft Defender XDR to hunt for suspicious processes spawned by wrapper.exe or unauthorized access to LSASS memory [7][14].

Long-Term Strategy: Operational Resilience

Beyond immediate patching, long-term security depends on moving from manual configuration to automated enforcement. Operation Winter SHIELD, which began the week of February 2, 2026, emphasizes closing the "implementation gap" through consistent control application [1][5].

Strategy Area Recommended Action Impact
Identity Enable Baseline Security Mode Enforces phish-resistant MFA and blocks legacy authentication [12].
Access Implement Least-Privilege Restricts DBCC stackdump to sysadmins and limits build pipeline tokens [6][12].
Supply Chain Secure Build Pipelines Requires identity isolation and signed artifacts for all production code [12].
Automation Use Secure Defaults Reduces reliance on human vigilance and error-prone manual setups [3][5].

Risks & Limitations

While these steps significantly minimize risk, they do not offer absolute protection. Manual intervention is often required when legacy systems are identified that no longer support modern authentication paths [12].

Before deploying wide-scale updates such as KB5073177 or KB5074109, administrators should review the Microsoft Update Catalog for known issues related to specific server versions, such as Windows Server 2025 or Windows Server 23H2 [11][15]. Organizations running Windows Server 2008 R2 or older must maintain an Extended Security Update (ESU) license to receive these critical fixes [11].

If internal teams are unable to verify the removal of persistence mechanisms—such as malicious sspicli.dll files used in DLL sideloading—it is generally recommended to seek specialized forensic assistance [3][7]. Overlooking a single compromised developer account or token can potentially leave a pathway open for future production intrusions [12].

Risks, Limits, and When to Stop

Implementing security updates and AI safeguards involves inherent complexities that can lead to system instability or incomplete protection if not managed correctly. Understanding these boundaries is essential for maintaining operational resilience.

Potential Risks of Implementation

Security controls often fail not because of a lack of guidance, but because they are inconsistently enforced or bypassed via legacy paths [7][10]. In complex environments where devices, applications, and cloud services were not designed to work together, deploying new security measures can lead to:

  • Operational Friction: Strict security defaults may disrupt existing workflows or slow down system performance [10][11].
  • Legacy Vulnerabilities: Older systems, such as Windows Server 2008, require specific Extended Security Updates (ESU); attempting to secure these without official patches may leave critical gaps [13].
  • AI Trade-offs: While AI tools provide a "judgment-free space," they introduce risks regarding privacy, overreliance, and the potential erosion of critical thinking [1].
Risk Factor Potential Impact
Incomplete Enforcement Threat actors exploit gaps between policy and production [11].
Legacy Systems Increased exposure to cybercrime due to lack of native security features [13].
AI Misuse Exposure to manipulative interactions or misinformation [15].

Critical Limitations

It is important to recognize that security awareness alone does not improve safety; improvement comes from execution and the closing of implementation gaps [11]. Technical solutions like the Microsoft Education Security Toolkit or Family Safety controls are not "set-and-forget" fixes [1][15]. They require continuous validation to ensure risk decisions remain traceable and effective as digital environments change [11].

Furthermore, security is a process rather than a final product. Even with advanced initiatives like Operation Winter SHIELD, the margin for error remains small because attack chains often complete before defenders can intervene [10][11].

When to Seek Professional Support

There are specific scenarios where standard user or internal IT actions may be insufficient. It is generally advisable to pause and consult with security specialists in the following situations:

  • Active Incident Suspected: If there are signs of an active breach, such as unauthorized access or ransomware, immediate expert intervention is required to minimize dwell time [10].
  • Compliance Requirements: When managing sensitive information like student records, financial aid data, or intellectual property, professional audit and implementation are necessary to meet regulatory standards [4][15].
  • Persistent Implementation Gaps: If your organization struggles to move from security "policy" to actual "enforcement" in production, external guidance may be needed to overcome operational complexity [10][11].
  • Legacy Infrastructure: If the environment relies heavily on outdated operating systems that require complex servicing stacks or ESU management [13].

Warning: Attempting to manually bypass security prompts or legacy blocks can inadvertently open pathways for cybercrime services and fraud [8][10].

If you are unsure about the stability of a security configuration, it is usually safer to verify the deployment with an expert rather than risk a system-wide failure or data exposure.

FAQ

How do I know if my system is protected against the latest vulnerabilities?

To help ensure protection, users should verify that the January 2026 Security Updates [3][5] and the February 2026 Exchange Server Security Updates [11] are installed. These updates are cumulative, meaning the latest release typically includes all previous security fixes for Windows 10, Windows 11, and Windows Server [11][12]. You can check your update history in the system settings or via the Microsoft Update Catalog [12].

Are older versions of Exchange Server still receiving security patches?

Exchange 2016 and Exchange 2019 are currently out of support [11]. Security updates for these versions are only available to organizations enrolled in the Extended Security Update (ESU) program, which is expected to remain valid until April 2026 [11]. For those without an ESU, it is generally recommended to upgrade to Exchange SE as soon as possible to maintain a supported security posture [11].

Do I need to install every previous update before the February release?

No, security updates (SUs) are cumulative [11]. If you are running a Cumulative Update (CU) that is supported by the current SU, you can simply install the latest update without needing to install previous versions in sequential order [11]. This applies to both Windows and Exchange Server environments [11][12].

What are the risks of ignoring these specific security alerts?

Ignoring updates can leave systems vulnerable to various exploits, including those targeting the Windows Kernel, SMB Server, and Microsoft Office [5][6]. Historical data suggests that state-sponsored actors may pounce on unpatched vulnerabilities to gain unauthorized access [8]. Furthermore, updates often include defense-in-depth improvements that strengthen security-related features beyond just fixing known bugs [3].

Does Microsoft Sentinel require a specific license to use the new security features?

The Microsoft Sentinel platform is generally available in the Microsoft Defender portal, even for customers who do not have a Microsoft Defender XDR or E5 license [13]. However, users should prepare for a transition, as Microsoft Sentinel will no longer be supported in the Azure portal after March 31, 2027 [13]. Early onboarding to the unified Defender portal may help prevent management gaps during this transition [13].

Can I automate the auditing of security events on my servers?

Microsoft is currently rolling out automatic Windows event-auditing configuration for sensors v3.x in public preview [14]. This feature is designed to automatically apply required auditing settings to new sensors and correct misconfigurations on existing ones [14]. This potentially streamlines deployment and ensures that critical data is captured for Microsoft Defender for Identity detections [14][15].

Summary / Key Takeaways

The security landscape in early 2026 is defined by a shift from theoretical awareness to active enforcement. With the launch of Operation Winter SHIELD and the ongoing exploitation of specific vulnerabilities, the focus remains on closing the gap between security guidance and real-world implementation [1][3][5].

  • Prioritize Immediate Patching: Critical vulnerabilities, including CVE-2025-40551, CVE-2025-40536, and CVE-2025-26399, have seen active exploitation [11]. Organizations using SolarWinds Web Help Desk should update software immediately, rotate administrative credentials, and isolate any potentially compromised hosts [11].
  • Operational Resilience through Execution: Operation Winter SHIELD, which began the week of February 2, 2026, emphasizes that security maturity is measured by enforced production controls rather than policy documents [1][5]. This initiative focuses on high-impact controls to reduce exposure to cybercrime [5].
  • Safety-by-Design for Emerging Tech: Research indicates that 91% of people are concerned about harms introduced by AI, leading to a greater industry emphasis on "safety-by-design" for online services [4][9].
  • Strengthen Identity Governance: New capabilities like Microsoft Entra Agent ID (now in public preview) allow organizations to better govern and protect agent identities, moving away from less secure "on behalf of" (OBO) models [15].

If you’re unsure, it’s usually cheaper to ask someone once than to fix a mistake later.

Quellen

[1] Monthly news - February 2026 | Microsoft Community Hub

[2] Building a safer digital future, together

[3] The security implementation gap: Why Microsoft is supporting Operation Winter...

[4] Safer Internet Day 2026: Helping students be AI aware | Microsoft Education Blog

[5] Updates in two of our core priorities - The Official Microsoft Blog

[6] Microsoft releases urgent Office patch. Russian-state hackers pounce.

[7] Analysis of active exploitation of SolarWinds Web Help Desk | Microsoft Secur...

[8] Released: February 2026 Exchange Server Security Updates | Microsoft Communit...

[9] Microsoft January 2026 Security Updates (FYI) - Microsoft Q&A

[10] Security Update Guide - Microsoft Security Response Center

[11] KB5073177 - Description of the security update for SQL Server 2025 GDR: Janua...

[12] Release notes for Microsoft Edge Security Updates

[13] Security Update Guide - Microsoft Security Response Center

[14] January 13, 2026—KB5073455 (OS Build 22631.6491) - Microsoft Support

[15] The Hacker News - Google News

[16] BeyondTrust warns of critical RCE flaw in remote support software

[17] SolarWinds Web Help Desk Exploited for RCE in Multi-Stage Attacks on Exposed ...

[18] CISA Adds Actively Exploited SolarWinds Web Help Desk RCE to KEV Catalog

[19] Microsoft February 2026 Patch Tuesday fixes 6 zero-days, 58 flaws

[20] Microsoft releases Windows 10 KB5075912 extended security update

[21] Microsoft warns Secure Boot certificates will expire soon — what to expect

[22] APT28 Uses Microsoft Office CVE-2026-21509 in Espionage-Focused Malware Attacks

[23] ZAST.AI Raises $6M Pre-A to Scale "Zero False Positive" AI-Powered ...

[24] Windows 11 KB5077181 & KB5075941 cumulative updates released

[25] BeyondTrust Fixes Critical Pre-Auth RCE Vulnerability in Remote Support and PRA

[26] Microsoft rolls out new Secure Boot certificates before June expiration

[27] Azure power wobble knocks Windows Update offline

[28] Azure outages ripple across multiple dependent services

[29] Microsoft starts with identification of insecure RC4 encryption

[30] Springbrook Software 2026 Cybersecurity Survey: Local Governments Abandoning ...

[31] Encryption Consulting Unveils Industry-First CBOM Solution to Secure Software...

[32] Service Robotics Market to Surpass USD 209 Bn by 2031 as Autonomous Systems A...

[33] PQShield is Recognized as a Progressive Company in the MarketsandMarkets

[34] Quantum Machines to Establish Flagship Hub at the Illinois Quantum and Microe...

[35] Microsoft Patch Tuesday security updates for February 2026 fix six actively e...

[36] CVE-2026-1731 | Arctic Wolf

[37] Microsoft Patch Tuesday matches last year’s zero-day high with six actively e...

[38] Microsoft Patch Tuesday February 2026 – 54 Vulnerabilities Fixed, Including 6...

[39] Week in review: Notepad++ supply chain attack details and targets, Patch Tues...

[40] Microsoft Patch Tuesday, February 2026 Security Update Review | Qualys

[41] Microsoft Releases February 2026 Patch Tuesday Updates

[42] Microsoft prepares to refresh Secure Boot’s digital certificate

[43] I tested Windows 11 February 2026 Updates: Everything new, improved, and fixed

[44] Zero Day Initiative — The February 2026 Security Update Review

[45] CVE-2026-21509: APT28 Exploits Microsoft Office Zero-day Vulnerability

[46] Fancy Bear Hackers Exploiting Microsoft Zero-Day Vulnerability to Deploy Back...

[47] February Patch Tuesday: Microsoft drops six zero-days | Computer Weekly

[48] Critical Fortinet FortiClient EMS Vulnerability Allows Remote Code Execution

[49] Researchers delve inside new SolarWinds RCE attack chain | Computer Weekly

[50] BeyondTrust fixes easy-to-exploit pre-auth RCE vulnerability in remote access...

[51] CISA confirms exploitation of VMware ESXi flaw by ransomware attackers - Help...

[52] CVE-2026-21643: Critical SQL Injection in FortiClientEMS - Arctic Wolf

[53] 1,000+ Flaws Found, Including Critical IT & ICS Vulnerabilities

[54] Industry Exchange Cyber 2026: OPSWAT’s Michael Arcamone on why there’s no suc...

[55] The Shadow Campaigns: Uncovering Global Espionage

[56] 2026 Will Be the Year Defense Must Match the Speed of AI-Powered Offense

[57] February 2026 Patch Tuesday forecast: Lots of OOB love this month - Help Net ...

[58] Known Exploited Vulnerabilities Catalog | CISA

[59] Heroes of the Storm Live Patch Notes - February 10, 2026

[60] I run this one PowerShell script on every Windows install, and it changes eve...

[61] Fallout from latest Ivanti zero-days spreads to nearly 100 victims

[62] Microsoft Patch Tuesday – February 2026 - Lansweeper

[63] Claude AI finds 500 high-severity software vulnerabilities

[64] CVE-2026-21509: Actively Exploited Microsoft Office Zero-Day Forces Emergency...

[65] Microsoft releases Windows 11 KB5077181 with new features and critical fixes

[66] Patch Tuesday February 2026: Security Updates & CVE Analysis

[67] February 2026 Microsoft Patch Tuesday | Tenable®

[68] Microsoft Discloses ‘Extraordinarily High’ Number Of Zero-Day Vulnerabilities...

[69] CVE-2026-25846: CWE-532 in JetBrains YouTrack - Live Threat Intelligence - Th...

[70] Article

[71] CVE-2025-15317: Allocation of Resources Without Limits or Throttling in Taniu...

[72] Fortinet patches actively exploited FortiOS SSO auth bypass (CVE-2026-24858)

[73] CVE-2026-25951: CWE-22: Improper Limitation of a Pathname to a Restricted Dir...

[74] Windows 11 February 2026 Update: New Features, Quality Improvements & Eve...

[75] Weekly Report: New Hacking Techniques and Critical CVEs 27 Jan- 2 Feb 2026

[76] Windows 11 KB5077181 25H2 out with new features, direct download links for of...

[77] CVE-2026-20805: Microsoft Fixes Actively Exploited Windows Desktop Manager Ze...

[78] KB5074109 - Details, Issues, & Feedback - NinjaOne

[79] NVD - CVE-2026-24061

[80] Patch Tuesday Updates for Windows 11 and 10, February 10, 2026

[81] NVD - CVE-2026-21858

[82] Microsoft tightens Windows security with app transparency and user consent - ...

[83] 3 Top Cybersecurity Stocks to Buy in February | The Motley Fool

[84] BeyondTrust Remote Access Products 0-Day Vulnerability Allows Remote Code Exe...

[85] CrowdStrike is the Only Vendor Named as a Customers’ Choice in the 2025 Gartn...

[86] 9th February – Threat Intelligence Report - Check Point Research

[87] Azure outage disrupts VMs and identity services for over 10 hours

[88] Microsoft Exchange Online Erroneously Flags Legitimate Emails as Phishing

[89] Microsoft’s January 2026 Patch Tuesday Addresses 113 CVEs (CVE-2026-20805)

[90] Microsoft fixes six actively exploited flaws in latest Windows 11 update

[91] Windows 11 February 2026 Patch Tuesday Released: KB5077181 and KB5075941 Now ...

[92] heise security: Alerts,Newsticker,Hintergrund und Events | heise online

[93] Microsoft February 2026 Security Updates

[94] Microsoft February 2026 Security Updates

[95] Fancy Bear Hackers Abuse Microsoft Zero-Day in Email Theft Campaign

[96] XFN 1.1 profile

[97] Cision - Global Cloud-Based Communications and PR Solutions Leader

[98] PR Newswire for Agency Partners

[99] PR Newswire | LinkedIn

[100] Cision - Global Cloud-Based Communications and PR Solutions Leader

[101] The Hacker News

[102] fonts.googleapis.com

[103] The Hacker News | LinkedIn

[104] fonts.googleapis.com

[105] XFN 1.1 profile

[106] BleepingComputer (@[email protected]) - Infosec Exchange

[107] Help Net Security | LinkedIn

[108] CVE-2026-1731: Pre-Auth RCE in BeyondTrust Remote Support & PRA

[109] Offensive Sequence

[110] Services - OffSeq

[111] Career - OffSeq

[112] Services - OffSeq

[113] Offensive Sequence (@[email protected]) - Infosec Exchange

[114] Offensive Sequence (@offseq.bsky.social)

[115] OffSeq | LinkedIn

Relevant Services

More from the Blog

Brauchen Sie Hilfe?

Wir reparieren Ihren PC oder Laptop schnell und zuverlässig.

Jetzt Reparatur anfragen