Week of February 16, 2026: Dell zero-day exploited, Adidas and French bank breaches disclosed

Security leaders tracked a China-linked espionage campaign that exploited a Dell RecoverPoint zero-day for more than a year, newly disclosed data breaches at Adidas and France's FICOBA bank account registry, and fresh regulatory moves from Ireland's Data Protection Commission and the UK government targeting AI chatbot safety. CISA also expanded its Known Exploited Vulnerabilities catalog twice during the week, adding a Dell hard-coded credential flaw and an actively exploited Chrome zero-day, while researchers published new design weaknesses affecting major cloud password managers.

CISA adds Dell and GitLab flaws to Known Exploited Vulnerabilities Catalog

CISA added two more vulnerabilities to its Known Exploited Vulnerabilities Catalog on February 18, 2026, citing evidence of active exploitation. The entries covered CVE-2021-22175, a GitLab Server-Side Request Forgery vulnerability, and CVE-2026-22769, a Dell RecoverPoint for Virtual Machines hard-coded credentials vulnerability. Federal Civilian Executive Branch agencies were required to remediate both flaws under Binding Operational Directive 22-01, and CISA urged all organizations to prioritize the vulnerabilities as part of routine vulnerability management given their documented use in real-world attacks. (CISA)

China-linked group exploited Dell RecoverPoint zero-day since 2024

Google's Threat Intelligence Group and Mandiant disclosed that a suspected China-linked cyberespionage cluster, UNC6201, had been exploiting a critical Dell RecoverPoint for Virtual Machines zero-day, CVE-2026-22769, since at least mid-2024. The attackers used hard-coded Tomcat Manager credentials to deploy a SLAYSTYLE webshell, then installed the BRICKSTORM and GRIMBOLT backdoors to maintain long-term access, pivoting into VMware virtual infrastructure through techniques including stealthy network-interface tricks. Dell published remediation guidance, and Mandiant released indicators of compromise and detection rules to help organizations identify the backdoors. (Help Net Security)

Adidas investigates alleged breach tied to third-party provider

Adidas confirmed it was investigating a possible data breach linked to a third-party customer service provider after an individual claiming membership in the Lapsus$ Group posted an alleged extranet dump on BreachForums. The stolen dataset reportedly contained 815,000 rows of data, including names, email addresses, passwords, birthdays, company names and technical details. Adidas said there was no indication its own IT infrastructure, e-commerce platforms, or consumer data were affected. The company faced a similar incident in May 2025 involving a different third-party system. (Help Net Security)

French bank account registry breach exposes 1.2 million IBANs

France's Ministry of the Economy and Finance disclosed that an intruder accessed the national bank account registry, FICOBA, in late January 2026 after obtaining a civil servant's login credentials. The breach exposed data tied to 1.2 million accounts, including IBANs, account holder names, addresses and, in some cases, tax identification numbers. Authorities said the exposed information could not be used to view balances or initiate transfers, but warned it could support fraudulent direct-debit requests or impersonation scams, and the matter was referred to the French data protection authority and prosecutors. (Help Net Security)

Ireland's DPC opens investigation into X over Grok deepfakes

Ireland's Data Protection Commission opened a formal investigation into X over its Grok chatbot after reports that users could prompt the tool to generate sexualized deepfakes, including images allegedly involving children. The regulator said the probe would examine whether the company handled EU and EEA users' personal data lawfully, applied appropriate safeguards before deploying the generative AI feature, and assessed the associated risks. Deputy Commissioner Graham Doyle said the DPC had been engaging with X since the first media reports emerged. The investigation adds to a series of EU inquiries already targeting Grok. (Help Net Security)

UK government moves to tighten AI chatbot rules for children

The UK government announced plans for immediate action to compel AI chatbot providers to comply with online safety laws protecting children, following an intervention after non-consensual intimate images were shared through the Grok chatbot. Ministers said new legal powers would allow updates to online safety rules within months based on a consultation covering minimum social media ages, limits on infinite scrolling, children's chatbot use, and VPN restrictions where safety systems are bypassed. Technology Secretary Liz Kendall said the government would tighten chatbot rules rather than wait for the consultation to conclude. (Help Net Security)

CISA flags actively exploited Chrome zero-day in KEV update

CISA added four vulnerabilities to its Known Exploited Vulnerabilities Catalog on February 17, 2026, based on evidence of active exploitation. The additions included CVE-2026-2441, a use-after-free flaw in Chromium's CSS processing component that Google had patched days earlier after confirming an in-the-wild exploit, alongside older bugs affecting Microsoft Windows, Synacor Zimbra Collaboration Suite, and TeamT5 ThreatSonar Anti-Ransomware software. Federal agencies were required to remediate the flaws under Binding Operational Directive 22-01, and CISA again urged all organizations to prioritize these vulnerabilities in their patching programs. (CISA)

Researchers detail design weaknesses in major password managers

Researchers from ETH Zurich and Università della Svizzera italiana published findings showing that four widely used cloud-based password managers, Bitwarden, LastPass, Dashlane, and 1Password, contained design weaknesses that could let an attacker who compromises the vendor's vault-storage servers recover or tamper with users' encrypted passwords. The team presented 12 attack scenarios against Bitwarden, 7 against LastPass, 6 against Dashlane, and 3 against 1Password, tied to flaws such as missing key authentication and weak key separation. Vendors said they found no evidence the attacks had been used against customers and had begun addressing some of the flaws. (Help Net Security)