CISO Daily Brief: Dell Zero-Day Exploitation, AI Security Risks, and Supply Chain Threats (Feb 18, 2026)

Today’s security landscape is marked by active exploitation of critical vulnerabilities, evolving AI security risks, and persistent supply chain threats. CISOs should prioritize rapid assessment and response to these developments, as several incidents have direct enterprise and regulatory implications. Below, we summarize the most urgent items and provide actionable guidance for executive engagement and internal verification.

Top Items CISOs Should Care About (Priority)

Dell RecoverPoint for VMs Zero-Day CVE-2026-22769 Exploited Since Mid-2024

• What happened: A high-severity zero-day vulnerability in Dell RecoverPoint for VMs has been actively exploited since mid-2024, with confirmed nation-state involvement.
• Why it matters: Exploitation of backup infrastructure can lead to data loss, ransomware, and regulatory exposure.
• What to verify internally:
  • Inventory and version status of all Dell RecoverPoint for VMs deployments
  • Patch status and compensating controls in place
  • Review of backup integrity and recent activity logs
  • Incident response readiness for backup compromise scenarios
• Exec questions to prepare for:
  • Are we running affected Dell RecoverPoint versions?
  • Have we detected any signs of compromise?
  • What is our backup recovery assurance?
  • What is our communication plan if data loss occurs?
• Sample CISO response: "We have identified all Dell RecoverPoint instances, applied available mitigations, and are closely monitoring for indicators of compromise while validating backup integrity."

CISA Flags Four Security Flaws Under Active Exploitation in Latest KEV Update

• What happened: CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, all under active exploitation.
• Why it matters: These flaws require urgent patching to reduce risk of compromise and regulatory scrutiny.
• What to verify internally:
  • Immediate identification of affected assets
  • Patch deployment status and timelines
  • Monitoring for exploitation attempts
  • Communication with IT and business stakeholders
• Exec questions to prepare for:
  • Are any of our systems vulnerable?
  • How quickly can we patch?
  • What is our exposure window?
  • Are there any signs of exploitation?
• Sample CISO response: "We are expediting patching for all CISA-flagged vulnerabilities and increasing monitoring for related threat activity."

Researchers Show Copilot and Grok Can Be Abused as Malware C2 Proxies

• What happened: Security researchers demonstrated that AI assistants like Copilot and Grok can be leveraged as command-and-control (C2) proxies for malware operations.
• Why it matters: This introduces a novel attack vector that could bypass traditional security controls.
• What to verify internally:
  • Review AI assistant usage policies and access controls
  • Monitor for anomalous AI-related network activity
  • Assess logging and detection capabilities for AI tool misuse
  • Engage with vendors on mitigation guidance
• Exec questions to prepare for:
  • Are our AI tools at risk?
  • What controls do we have in place?
  • How are we monitoring for abuse?
  • What is our vendor engagement strategy?
• Sample CISO response: "We are reviewing AI assistant configurations and monitoring for suspicious activity, while coordinating with vendors on emerging controls."

Keenadu Firmware Backdoor Infects Android Tablets via Signed OTA Updates

• What happened: The Keenadu backdoor was discovered in Android tablet firmware distributed through signed over-the-air (OTA) updates and Google Play apps.
• Why it matters: Compromised firmware undermines device trust and can enable persistent, hard-to-detect threats.
• What to verify internally:
  • Inventory of affected Android devices and firmware versions
  • Review of mobile device management (MDM) controls
  • Assessment of supply chain and update validation processes
  • Communication with device vendors for remediation guidance
• Exec questions to prepare for:
  • Do we have affected devices in our fleet?
  • How do we validate firmware integrity?
  • What is our response plan for compromised devices?
  • How are we engaging with suppliers?
• Sample CISO response: "We are working to identify and remediate any affected Android devices, and are reviewing supply chain controls with our vendors."

Notepad++ Fixes Hijacked Update Mechanism Used to Deliver Targeted Malware

• What happened: Attackers hijacked the Notepad++ update mechanism to deliver targeted malware, impacting supply chain trust.
• Why it matters: Compromised update channels can propagate malware widely across organizations.
• What to verify internally:
  • Review of software update sources and integrity checks
  • Assessment of endpoint protection coverage
  • Inventory of Notepad++ installations and update status
  • Communication with users about safe update practices
• Exec questions to prepare for:
  • Were any endpoints compromised via this vector?
  • How do we validate software updates?
  • What is our process for responding to supply chain incidents?
• Sample CISO response: "We have reviewed our update processes and are ensuring all Notepad++ installations are updated from trusted sources only."

SmartLoader Attack Uses Trojanized Oura MCP Server to Deploy StealC Infostealer

• What happened: The SmartLoader attack campaign used a trojanized Oura MCP server to distribute the StealC infostealer malware.
• Why it matters: Trojanized infrastructure can facilitate large-scale data theft and compromise.
• What to verify internally:
  • Review of connections to Oura MCP servers
  • Endpoint monitoring for StealC indicators
  • Assessment of third-party service dependencies
  • Incident response procedures for infostealer detection
• Exec questions to prepare for:
  • Are we exposed to this attack vector?
  • What monitoring do we have in place?
  • How do we manage third-party risks?
• Sample CISO response: "We are monitoring for StealC activity and reviewing third-party connections to ensure no exposure to the trojanized infrastructure."

Microsoft says bug causes Copilot to summarize confidential emails

• What happened: A bug in Microsoft Copilot led to the unintentional summarization and potential exposure of confidential email content.
• Why it matters: This incident raises significant data privacy and regulatory compliance concerns.
• What to verify internally:
  • Review of Copilot deployment and configuration
  • Assessment of data access controls and privacy settings
  • Monitoring for unauthorized summarization or data leakage
  • Communication with Microsoft for remediation updates
• Exec questions to prepare for:
  • Was any sensitive data exposed?
  • How do we control AI assistant access to confidential information?
  • What is our incident response plan for data leakage?
• Sample CISO response: "We are reviewing Copilot configurations and working with Microsoft to ensure privacy controls are effective and up to date."

Flaws in popular VSCode extensions expose developers to attacks

• What happened: Vulnerabilities in widely used VSCode extensions have exposed developers to potential attacks and code compromise.
• Why it matters: Developer tool vulnerabilities can introduce supply chain risks and impact code integrity.
• What to verify internally:
  • Inventory of VSCode extension usage and versions
  • Patch and update status for all developer tools
  • Review of secure coding and development environment practices
  • Communication with development teams on risks and mitigations
• Exec questions to prepare for:
  • Are our developers using vulnerable extensions?
  • How do we manage developer tool risks?
  • What controls are in place for code integrity?
• Sample CISO response: "We are coordinating with development teams to update vulnerable extensions and reinforce secure development practices."

Chinese hackers exploiting Dell zero-day flaw since mid-2024

• What happened: Nation-state actors, attributed to China, have been exploiting the Dell RecoverPoint zero-day since mid-2024.
• Why it matters: Nation-state exploitation of critical infrastructure elevates enterprise and regulatory risk.
• What to verify internally:
  • Review of threat intelligence and IOCs related to this campaign
  • Assessment of Dell RecoverPoint exposure and monitoring
  • Engagement with government and industry partners
  • Review of incident response and crisis communication plans
• Exec questions to prepare for:
  • Are we a target of this campaign?
  • What is our exposure to nation-state threats?
  • How are we collaborating with external partners?
• Sample CISO response: "We are leveraging threat intelligence and collaborating with partners to monitor for nation-state activity targeting our infrastructure."

New Keenadu backdoor found in Android firmware, Google Play apps

• What happened: A new variant of the Keenadu backdoor has been identified in Android firmware and Google Play apps, expanding the scope of affected devices.
• Why it matters: This increases the risk of persistent compromise across a broader device base.
• What to verify internally:
  • Update device inventories for new Keenadu indicators
  • Review mobile app vetting and update processes
  • Coordinate with vendors for patching and remediation
  • Assess user awareness and device hygiene practices
• Exec questions to prepare for:
  • How many devices are potentially affected?
  • What is our mobile device risk posture?
  • How do we ensure ongoing device integrity?
• Sample CISO response: "We are updating our mobile device inventories and working with vendors to address the expanded Keenadu threat."

CISO Action Checklist Today

• Identify and patch all Dell RecoverPoint for VMs instances; monitor for compromise.
• Expedite patching for all CISA-flagged vulnerabilities; increase monitoring for exploitation.
• Review AI assistant (Copilot, Grok) configurations and monitor for abuse or data leakage.
• Inventory Android devices and apps for Keenadu backdoor exposure; coordinate with vendors.
• Validate software update mechanisms and endpoint protection for Notepad++ and other tools.
• Monitor for StealC infostealer activity and review third-party service dependencies.
• Update VSCode extensions and reinforce secure development practices with engineering teams.
• Engage with threat intelligence partners regarding nation-state activity targeting infrastructure.
• Review incident response and crisis communication plans for supply chain and AI-related incidents.
• Communicate key risks and mitigations to executive and business stakeholders.