Microsoft's February Patch Tuesday just dropped a bombshell: six zero-days are being actively exploited in the wild right now. CVE-2026-21510 lets a single malicious link bypass Windows protections silently across all supported Windows versions. CVE-2026-21513 hits MSHTML, CVE-2026-21514 targets Word, CVE-2026-21533 escalates to SYSTEM via Remote Desktop Services, CVE-2026-21519 is another DWM privilege escalation (same component patched last month — attackers are clearly focused here), and CVE-2026-21525 is a VPN DoS that can drop corporate remote access. Patch now, no exceptions.
On the phishing front, Krebs is reporting on Starkiller — a new PhaaS that fundamentally breaks MFA. Instead of a static fake login page, it spins up a headless Chrome container that loads the REAL target site and acts as a live man-in-the-middle proxy. Every keystroke, MFA code, and session token passes through attacker infrastructure in real time. The platform even includes a live screen-streaming dashboard for operators. This isn't a phishing kit upgrade — it's MFA nullification as a service. Combined with the Roundcube CVSS 9.9 deserialization flaw (CVE-2025-49113) that was weaponized within 48 hours of disclosure and just hit the CISA KEV catalog, the attack surface today is exceptionally hot.
The developer supply chain took another hit: Cline CLI 2.3.0 was pushed via a compromised npm token on February 17, silently installing OpenClaw on developer machines via postinstall script. No malicious behavior confirmed beyond unauthorized installation, but the vector is textbook — compromised publish credentials, minimal file modification to evade diff-scanning, and a postinstall hook that most devs never audit. Separately, MIMICRAT (AstarionRAT) is a new C++ RAT delivered via ClickFix campaigns that bypasses ETW and AMSI before dropping a Lua-scripted shellcode loader communicating over HTTPS port 443 using web analytics traffic profiles. This one is built for stealth.