Daily Security Briefing #169

February 18, 2026 | Read Online

Search ad phishing, Critical unencrypted data, Evolving Android malware and more…

Executive Summary

Today’s cybersecurity landscape is marked by a mix of critical vulnerabilities, AI-driven threats, and evolving attack tactics. A critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 VoIP phones has been discovered and patched, while a commercial forensic extraction tool was used to break into a Kenyan activist’s phone during police custody. Furthermore, researchers have found signs of rapid weaponization of SmarterMail flaws on underground Telegram channels, and cybercriminals exploited Atlassian Cloud for large-scale spam campaigns targeting investors. Meanwhile, AI security research has led to the discovery of twelve new zero-day vulnerabilities in OpenSSL.

Top Articles

1. Critical Unauthenticated Stack Buffer Overflow in Grandstream GXP1600 VoIP Phones (FIXED)

Researchers at Rapid7 Labs discovered a critical unauthenticated stack-based buffer overflow vulnerability, CVE-2026-2329, which could allow remote attackers to execute code with root privileges on affected devices. A firmware update is available to remediate the issue.

https://WWW.RAPID7.COM/BLOG/POST/VE-CVE-2026-2329-CRITICAL-UNAUTHENTICATED-STACK-BUFFER-OVERFLOW-IN-GRANDSTREAM-GXP1600-VOIP-PHONES-FIXED

2. AI Found Twelve New Vulnerabilities in OpenSSL

An AI system discovered twelve new zero-day vulnerabilities in OpenSSL, each responsibly disclosed to the OpenSSL team during the fall and winter of 2025. This highlights the growing role of AI in cybersecurity research.

https://WWW.SCHNEIER.COM/BLOG/ARCHIVES/2026/02/AI-FOUNDS-TWELVE-NEW-VULNERABILITIES-IN-OPENSSL.HTML

3. Two Types of Threat Intelligence That Make Security Work

This article emphasizes the importance of internal and external threat intelligence in connecting what’s happening inside an environment with attacker plans outside it.

https://BLOG.CHECKPOINT.COM/RESEARCH/TWO-TYPES-OF-THREAT-INTELLIGENCE-THAT-MAKE-SECURITY-WORK/

4. OpenClaw AI Framework v2026.2.17 Adds Anthropic Model Support Amid Credential Theft Bug Concerns

The latest version of OpenClaw, an open-source autonomous AI assistant, adds support for Anthropic’s Claude Sonnet 4.6 model while addressing growing security concerns after researchers documented the first in-the-wild credential theft targeting its configuration files.

https://GBHACKERS.COM/OPENCLAW-AI-FRAMEWORK-V2026-2-17/

5. Cryptocurrency Scams in Asia Combine Malvertising and Pig Butchering, Causing Losses Up to ¥10 Million

A rising wave of cryptocurrency scams is seen in Asia, blending malvertising and pig butchering techniques to create a more deceptive and scalable attack model.

https://GBHACKERS.COM/CRYPTOCURRENCY-SCAMS/

6. Citizen Lab Finds Cellebrite Tool Used on Kenyan Activist’s Phone in Police Custody

New research from Citizen Lab found signs that the commercial forensic extraction tool manufactured by Israeli company Cellebrite was used to break into a prominent dissident’s phone during police custody.

https://THEHACKERNEWS.COM/2026/02/CITIZEN-LAB-FINDS-CELLEBRITE-TOOL-USED.HTML

7. Cybercriminals Exploit Atlassian Cloud For Large-Scale Spam Campaigns Targeting Investors

Threat actors exploited Atlassian Jira Cloud to launch large-scale spam campaigns targeting investors and government entities, abusing the platform’s trusted email system.

https://CYBERPRESS.ORG/ATLASSIAN-CLOUD-POWERS-SPAM-SCAMS/

8. ClickFix Social Engineering Fuels Matanbuchus 3.0 AstarionRAT Attack

Researchers uncovered a sophisticated attack chain where attackers used ClickFix social engineering to deliver Matanbuchus 3.0 malware, ultimately deploying AstarionRAT.

https://CYBERPRESS.ORG/MATANBUCHUS-3-0-DEPLOYS-ASTARIONRAT/

9. Telegram channels expose rapid weaponization of SmarterMail flaws

Monitoring underground Telegram channels revealed rapid weaponization of CVE-2026-24423 and CVE-2026-23760 tied to ransomware activity.

https://WWW.BLEEPINGCOMPUTER.COM/NEWS/SECURITY/TELEGRAM-CHANNELS-EXPOSE-RAPID-WEAPONIZATION-OF-SMARTERMAIL-FLAWS/

10. Grandstream GXP1600 VoIP Phones Exposed to Unauthenticated Remote Code Execution

A critical security flaw in the Grandstream GXP1600 series of VoIP phones allows an attacker to seize control of susceptible devices.

https://THEHACKERNEWS.COM/2026/02/GRANDSTREAM-GXP1600-VOIP-PHONES-EXPOSED.HTML

11. Cybercriminals Use ClickFix Social Engineering to Deliver AstarionRAT

Attackers used social engineering tactics to deliver the Matanbuchus 3.0 malware and ultimately deploy AstarionRAT.

https://CYBERPRESS.ORG/CYBERCRIMINALS-USE-CHECKPOINT-FIX-SOCIAL-ENGINEERING.HTML

AI Transparency: This newsletter uses AI to curate, rank, and summarize cybersecurity content from leading industry blogs. All articles link directly to original authors. Executive summaries are AI-generated based on article content. I curate the sources and deliver the digest—the original authors deserve the credit for their excellent work.