{"id":50,"date":"2026-02-26T07:25:27","date_gmt":"2026-02-26T07:25:27","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=50"},"modified":"2026-02-26T07:25:27","modified_gmt":"2026-02-26T07:25:27","slug":"double-tap-skimmers-promptspy-ai-30tbps-ddos-docker-malware-more","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=50","title":{"rendered":"Double-Tap Skimmers, PromptSpy AI, 30Tbps DDoS, Docker Malware & More"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Feb 23, 2026<\/span><\/span>Cybersecurity \/ Hacking<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Security news rarely moves in a straight line. This week, it feels more like a series of sharp turns, some happening quietly in the background, others playing out in public view. The details are different, but the pressure points are familiar.<\/p>\n

Across devices, cloud services, research labs, and even everyday apps, the line between normal behavior and hidden risk keeps getting thinner. Tools meant to protect, update, or improve systems are also becoming pathways when something goes wrong.<\/p>\n

This recap gathers the signals in one place. Quick reads, real impact, and developments that deserve a closer look before they become next week\u2019s bigger problem.<\/p>\n

\u26a1 Threat of the Week<\/strong><\/h2>\n

Dell RecoverPoint for VMs Zero-Day Exploited <\/strong>\u2014 A maximum severity security vulnerability in Dell RecoverPoint for Virtual Machines has been exploited as a zero-day by a suspected China-nexus threat cluster dubbed UNC6201 since mid-2024. The activity involves the exploitation of CVE-2026-22769 (CVSS score: 10.0), a case of hard-coded credentials affecting versions prior to 6.0.3.1 HF1. Per Google, the hard-coded credential relates to an \u00abadmin\u00bb user for the Apache Tomcat Manager instance that could be used authenticate to the Dell RecoverPoint Tomcat Manager, upload a web shell named SLAYSTYLE via the \u00ab\/manager\/text\/deploy\u00bb endpoint, and execute commands as root on the appliance to drop the BRICKSTORM backdoor and its newer version dubbed GRIMBOLT.<\/p>\n

\ud83d\udd14 Top News<\/strong><\/h2>\n