Playbook for the Secure Enterprise

CyberSecurity Latest Rundown

Heroes, your curated look at the current cybersecurity landscape for Feb 11, 2026.

HIGH SEVERITY ITEMS

• Google-Intel Security Audit Reveals Severe TDX Vulnerability
  ▶ Read analysis

  Date & Time: 2026-02-11T08:41:31

  A joint audit by Google and Intel has uncovered a severe vulnerability in Intel's Trust Domain Extensions (TDX) that could allow full system compromise. This affects confidential computing environments designed to protect data in use.

  Business impact

  Organizations relying on hardware-based isolation for sensitive workloads (like cloud tenants) may be vulnerable to breakout attacks, compromising the confidentiality of highly sensitive data.

  Recommended action

  Ask your IT team: "Do we utilize Intel TDX for any confidential computing workloads, and are firmware updates available to mitigate this flaw?"

  CVE: n/a | Compliance: SOX | Source: SecurityWeek ↗ ↗

• Chipmaker Patch Tuesday: Over 80 Vulnerabilities Addressed
  ▶ Read analysis

  Date & Time: 2026-02-11T11:00:00

  Intel and AMD have released advisories addressing over 80 vulnerabilities across their product lines. These hardware-level flaws often require firmware updates that can be complex to deploy.

  CVE: n/a | Compliance: SOX | Source: SecurityWeek ↗ ↗

• ICS Patch Tuesday: Vulnerabilities in Siemens, Schneider, Aveva
  ▶ Read analysis

  

  Date & Time: 2026-02-11T07:42:01

  Major industrial control system vendors including Siemens and Schneider Electric have patched multiple vulnerabilities. These affect operational technology environments essential for manufacturing and utilities.

  CVE: n/a | Compliance: SOX | Source: SecurityWeek ↗ ↗

OTHER NOTEWORTHY ITEMS

• Google Warns of Relentless Cyber Siege on Defense Industry
  ▶ Read analysis

  Date & Time: 2026-02-10T21:41:18

  Google Threat Intelligence reports that state-backed hackers are escalating attacks on the US defense industrial base, shifting tactics toward supply-chain compromise and workforce infiltration.

  CVE Details: n/a

  Source: HealthcareInfoSecurity ↗ ↗

EXECUTIVE INSIGHTS

• From Ransomware to Residency: Inside the Rise of the Digital Parasite

  ▶ Read insight

  Date & Time: 2026-02-10T13:59:00

  Summary: Picus Labs' Red Report 2026 analyzes 1.1 million malicious files, suggesting a shift from noisy ransomware encryption to "residency"—where attackers quietly persist in networks to steal data over long periods. This requires a shift in defense strategy from perimeter blocking to continuous internal monitoring.

  Source: The Hacker News ↗

VENDOR SPOTLIGHT

• Teleport (Specialized Vendor)

  ▶ Teleport details

  Specialization: Infrastructure Access Management (IAM) & Zero Trust Access

  Why Teleport Today: The disclosed Ivanti vulnerabilities highlight the critical risks associated with authentication bypass in traditional endpoint managers and legacy access gateways. Teleport is specifically relevant as a modern alternative that replaces these vulnerable access points with an identity-aware, certificate-based access plane, eliminating the static credentials that attackers often exploit following an auth bypass.

  Key Capability: Issuance of short-lived certificates for SSH, Kubernetes, Database, and RDP access to eliminate static credentials.

  Recommended Actions: 1. Navigate to Web Console → Management → Auth Connectors → New/Edit Connector 2. Navigate to Web Console → Management → Roles → [Select User Role] → Options → Edit JSON/YAML 3. Navigate to Web Console → Management → Roles → [Select User Role] → Options → Max Session TTL

  Verification Steps: - Initiate a terminal session via 'tsh ssh user@node' or the Web UI terminal - Inspect the issued certificate via 'tsh status' or by decoding the ~/.tsh/keys certificate

  This guidance assumes Teleport Enterprise or Cloud edition. UI paths may vary slightly between versions (e.g., v13 vs v15). Ensure you have 'editor' permissions for Auth Connectors and Roles.

  Learn More About Teleport ↗

DETECTION & RESPONSE KIT

• ⚠️ Disclaimer: Test all detection logic in non-production environments before deployment.

  1. Vendor Platform Configuration - Teleport

  TEXT [copy]

  # Actionable Guidance for Teleport
  # Generated: 2026-02-11 12:54:42
  
  # Step 1: Navigate to Web Console → Management → Auth Connectors → New/Edit Connector
  #   Purpose: Replace static local credentials with OIDC/SAML integration to centralize identity management and eliminate the attack surface of standalone user databases.
  #   Expected: Users are redirected to the corporate Identity Provider (Okta, Azure AD, etc.) for authentication, disabling reliance on potentially vulnerable local auth schemes.
  
  # Step 2: Navigate to Web Console → Management → Roles → [Select User Role] → Options → Edit JSON/YAML
  #   Purpose: Enforce 'require_session_mfa: true' to mitigate the risk of session hijacking or auth bypass by requiring a hardware touch (WebAuthn/YubiKey) for every specific protocol session (SSH, K8s, DB) initiation.
  #   Expected: Even if primary authentication is bypassed or credentials are compromised, the attacker cannot initiate a session without physical possession of the registered MFA device.
  
  # Step 3: Navigate to Web Console → Management → Roles → [Select User Role] → Options → Max Session TTL
  #   Purpose: Reduce 'max_session_ttl' to a minimal functional window (e.g., 1-8 hours) to limit the blast radius of any theoretically compromised certificate.
  #   Expected: Short-lived x.509 certificates are issued that expire automatically, rendering exfiltrated credentials useless after the brief TTL window.
  
  # Verification Steps:
  #   - Initiate a terminal session via 'tsh ssh user@node' or the Web UI terminal
  #     Expected: The system pauses and explicitly requests a WebAuthn/TouchID tap before granting the shell, confirming per-session MFA is active.
  #   - Inspect the issued certificate via 'tsh status' or by decoding the ~/.tsh/keys certificate
  #     Expected: The 'Valid before' timestamp reflects the newly configured short TTL (e.g., < 8 hours from issuance) rather than the default duration.
  

  2. YARA Rule for UNC3753 Malware Artifacts

  rule Detect_UNC3753_Malware_Artifacts {
  meta:
      description = "Detects malware artifacts associated with UNC3753 and Intel TDX audit findings"
      author = "Threat Rundown"
      date = "2026-02-12"
      reference = "https://www.securityweek.com/?p=45339"
      severity = "medium"
      tlp = "white"
  strings:
      $s1 = "Silent" ascii wide
      $s2 = "Chatty" ascii wide
      $s3 = "Luna" ascii wide
      $s4 = "UNC3753" ascii wide
      $s5 = "WinSCP" ascii wide
      $s6 = "Rclone" ascii wide
  condition:
      (any of ($s1,$s2,$s3,$s4) and any of ($s5,$s6))
  }
  

  3. SIEM Query — Ivanti EPM Authentication Bypass Attempt

  index=security sourcetype="ivanti:epm:access"
  status="success" OR status="200"
  | eval risk_score=case(
      src_user=="anonymous" AND method=="POST", 100,
      uri_path LIKE "%/auth/bypass%", 100,
      1==1, 0)
  | where risk_score >= 50
  | table _time, src_ip, dest_ip, uri_path, src_user, risk_score
  | sort -_time
  

  4. PowerShell Script — Check for Vulnerable libjpeg-turbo (Linux via SSH)

  POWERSHELL [copy]

  # Checks Linux hosts for vulnerable libjpeg-turbo versions via SSH
  # Requires Posh-SSH module
  $computers = "192.168.1.10", "192.168.1.11"
  $creds = Get-Credential
  
  foreach ($computer in $computers) {
      try {
          $session = New-SSHSession -ComputerName $computer -Credential $creds -AcceptKey
          $command = "rpm -qa | grep libjpeg-turbo"
          $output = Invoke-SSHCommand -SSHSession $session -Command $command
  
          if ($output.Output -match "libjpeg-turbo") {
              Write-Host "[ALERT] $computer: $($output.Output.Trim())" -ForegroundColor Red
          } else {
              Write-Host "[INFO] $computer: Library not found or check failed" -ForegroundColor Gray
          }
          Remove-SSHSession -SSHSession $session
      } catch {
          Write-Host "[ERROR] Could not connect to $computer" -ForegroundColor Yellow
      }
  }
  

  This rundown should provide a solid overview of the current threat landscape. Thank you to all our cyberheroes for your diligence and hard work. Stay vigilant!