Your everyday tools may be doing more than you think. |
From a text editor that can execute code to search ads that lead straight into cloud-hosted scams, the perimeter is shifting — quietly.
Meanwhile, VPN cracks and stealthy identity abuse are rewriting attacker playbooks. Read past newsletters here. |
|
| Here’s what you need to know: |
|
|
Windows Notepad Hit with RCE Flaw |
Microsoft has patched a vulnerability in the modern Windows Notepad app that could allow remote code execution when users open a specially crafted Markdown file.
Tracked as CVE-2026-20841, the flaw stems from improper validation of protocol handlers in Markdown links, allowing code execution in the user’s context if a malicious link is clicked. |
The legacy Notepad.exe is unaffected, but Store versions prior to 11.2510 require updating through the Microsoft Store.
Patch Notepad to version 11.2510+ via the Microsoft Store, enforce least privilege, restrict risky protocol handlers, and monitor for suspicious child processes spawned by Notepad. |
Malicious Bing Ads Push Azure-Hosted Fraud |
Threat actors are abusing Bing search ads and Microsoft Azure infrastructure to funnel users into large-scale tech support scams.
The campaign hit at least 48 U.S. organizations by placing malicious ads in brand searches like Amazon, redirecting users through WordPress to Azure-hosted scam pages with fake Microsoft alerts and rotating phone numbers. The campaign is active in the wild.
Train users to bypass search engine ads for brand sites, enforce DNS and web filtering to block newly registered domains and suspicious redirects, and monitor endpoints. |
FortiOS Flaw Bypasses VPN Logins |
Fortinet has disclosed an authentication bypass in FortiOS that could let attackers circumvent LDAP-based controls protecting VPN and SSO deployments.
A flaw in the fnbamd daemon mishandles LDAP responses when anonymous binds are enabled, causing FortiOS 7.6.0–7.6.4 to potentially grant VPN or FSSO access without valid credentials. There are no reports yet of exploitation in the wild.
Patch affected FortiOS devices, disable anonymous LDAP binds, enforce MFA on VPN and SSO access, and continuously monitor authentication logs for anomalous activity.
|
|
|
If someone targeted your VPN or SSO tonight… |
|
|
Yesterday's Pulse Check Results |
If a zero-day hit Android today, how exposed would you be? |
|
|
Security Tools You Can Use |
|
|
Microsoft Patches Actively Exploited VPN Flaw |
Microsoft has patched a denial-of-service vulnerability in the Windows Remote Access Connection Manager (RasMan) service that is being actively exploited in the wild. The flaw is a NULL pointer dereference during connection negotiation that lets a local attacker crash RasMan without elevated privileges or user interaction. |
Because RasMan supports Windows VPN connectivity, repeated crashes can disrupt operations. Apply the latest patch, enable automatic updates and RasMan service recovery, and monitor event logs and EDR telemetry for repeated crashes or suspicious interactions with RasMan components.
|
Picus Security Flags Shift to Low-Noise Intrusions |
Attackers are abandoning noisy ransomware campaigns in favor of stealth, persistence, and identity abuse, according to the Picus Red Report™ 2026.
Analyzing 1.1 million malware samples and 15.5 million adversarial actions in 2025, Picus found ransomware encryption fell 38% while 80% of leading techniques now emphasize evasion and long-term access. Process Injection (T1055) remains widespread, sandbox evasion is increasing, and credential theft (T1555) underscores identity as the primary target — leaving traditional detection prone to missing low-noise intrusions. Continuously test defenses against stealth techniques, enforce least-privilege identity controls, baseline normal user behavior, and monitor for abnormal credential or administrative tool usage across endpoints and cloud environments. |
|
|
Is your team struggling to balance security requirements with user experience?
Join us on February 24 at 10 AM ET for a webinar discussing how leading financial services teams are shifting to data-driven, risk-based mobile security for more precise responses. |
|
|
How Secure Is Your SSO Setup? |
Single sign-on (SSO) has become a prime target as attackers shift from breaking in to simply logging in.
With credential theft, token replay, and MFA fatigue attacks on the rise, a single misconfiguration can expose multiple connected systems at once. |
How to harden your SSO environment: |
-
Enforce phishing-resistant MFA, disable legacy authentication protocols, and harden federation and LDAP configurations to prevent bypass and token abuse.
- Apply least-privilege access controls and restrict user entitlements to minimize impact if credentials are compromised.
- Monitor for geolocation anomalies, abnormal login behavior, and suspicious token reuse to quickly detect identity-based attacks.
|
SSO streamlines access but centralizes risk, so strengthening identity controls, eliminating weak configurations, and monitoring behavior is essential to reduce exposure.
|
|
|
|
Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University, bringing years of hands-on experience to the field. |
|
|
Cybersecurity Insider is a TechnologyAdvice business |
© 2026 TechnologyAdvice, LLC. All rights reserved. |
TechnologyAdvice, 3343 Perimeter Hill Dr., Suite 215, Nashville, TN 37211, USA. |
|
|
|
