Week of February 9, 2026

Broadcom researchers disclosed Reynolds ransomware in February 2026, which embeds the vulnerable NsecSoft NSecKrnl driver (CVE-2025-68947) directly into its payload to terminate endpoint security processes before encrypting files. This single-binary approach eliminates the detection gap of traditional BYOVD attacks, making it harder for defenders to spot. The ransomware targets major EDR products including CrowdStrike Falcon, Cortex XDR, and others.

BusterCall is a proof-of-concept tool demonstrating a technique to bypass Windows Hypervisor-protected Code Integrity (HVCI) by manipulating Page Frame Numbers (PFNs) in page table entries. It enables arbitrary kernel function calls from user mode on HVCI-enabled systems by hijacking the System Service Descriptor Table (SSDT) through PFN swapping. The technique exploits the fact that HVCI validates page attributes rather than physical content, allowing an attacker to redirect a read-only code page to a modified copy on a writable donor page.

Darktrace observed an AI/LLM-generated malware sample exploiting CVE-2025-55182 (React2Shell) in its Cloudypots honeypot. The script, likely created via jailbroken LLM, deployed a XMRig cryptominer after achieving remote code execution. This incident demonstrates how AI-assisted development lowers the barrier for attackers to create functional exploits.

A technique called Zombie ZIP exploits a structural inconsistency in ZIP archives by setting the compression method to 'stored' while the payload remains DEFLATE-compressed, causing most security scanners to read high-entropy data and miss malicious content. Tracked as CVE-2026-0866 and CERT/CC VU#976247, it bypasses 98% of anti-malware engines and is actively exploited in ransomware and RAT campaigns.

Anthropic's Claude Code discovered over 500 zero-day vulnerabilities in popular open-source projects during automated security testing. The findings highlight the growing capability of LLMs to identify novel security flaws at scale, raising concerns about patch prioritization and the potential for malicious use.

A vulnerability in Harden-Runner (Community Tier) prior to version 2.14.2 allows outbound network connections to evade audit logging. The issue affects the egress-policy: audit mode, where traffic using sendto, sendmsg, and sendmmsg socket calls is not detected or logged. This could allow malicious outbound connections to go unnoticed in CI/CD pipelines.