SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense, Artificial Intelligence
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Microsoft Patch Tuesday Includes Six Zero-Days
Following several out-of-band emergency security updates in 2026, Microsoft has fixed six additional actively exploited zero-day vulnerabilities in their February Patch Tuesday releases. CVE-2026-21510 and CVE-2026-21513 both carry CVSS score 8.8 and both allow an unauthorized attacker to bypass a security feature over a network due to failure of a protection mechanism, in Windows Shell and MSHTML, respectively. Three of the flaws are rated CVSS 7.8: CVE-2026-21514 affects Microsoft Word and allows local security feature bypass due to reliance on untrusted inputs, and both CVE-2026-21533 CVE-2026-21519 allow privilege escalation by an authorized attacker, due to improper privilege management in Windows Remote Desktop and type confusion in Desktop Window Manager, respectively. The sixth zero-day, CVE-2026-21525, is rated CVSS 6.2, and allows local denial of service (DoS) by an unauthorized attacker, due to null pointer dereference in Windows Remote Access Connection Manager. All the exploited flaws have been added to the Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog (CISA KEV). Of the 59 total flaws addressed in the release, five are rated critical but are not known to be exploited: three vulnerabilities affecting Azure Arc, Azure Front Door, and Azure Function, and two affecting Microsoft Azure Container Instances (ACI) Confidential Containers.
Editor's Notes
After those recent out-of-cycle updates earlier this year you may be feeling a bit off on MS patches, but it’s time to get back on that horse and get these rolling. The patch set includes fixes for remote code injection in GitHub Copilot as well as updates for multiple development environments including VS Code, Visual Studio and JetBrains.
Apple Fixes Exploited Dynamic Linker Flaw
Apple's Patch Tuesday release notably includes a fix for a zero-day flaw affecting all Apple operating systems (iOS, iPadOS, macOS Tahoe, watchOS, tvOS, and visionOS) before version 26.3, reportedly exploited in targeted attacks against iOS before iOS 26. CVE-2026-20700 allows an attacker with memory write capability to execute arbitrary code due to a memory corruption issue in the operating system's dynamic link editor (dyld); the flaw has not been given a CVSS rating at the time of this writing, and Apple states that it has been addressed with improved state management. These attacks also involved two related flaws reported in December 2025: CVE-2025-14174, out of bounds memory access in Chrome's ANGLE, and CVE-2025-43529, arbitrary code execution due to a use-after-free issue in WebKit.
Editor's Notes
‘Apple updated everything,’ is a good way to look at this. Don’t wait on Apple to assign CVSS scores to roll out the updates; these flaws are already being targeted. This is a good time to make sure all your devices are on the 26 OS branch, to include making plans to replace those which won’t support it. Your mobile users may be asking about the precise location setting in 26.3 — remember that feature needs both device and carrier support.
Other Patch Tuesday Updates: SAP, Adobe, and ICS
On Tuesday, February 10, *SAP* published 27 security notes. Of those 26 are new and one is an update of an earlier note. The February release includes fixes for two critical flaws: CVE-2026-0488, a code injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor); and CVE-2026-0509, missing authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform. *Adobe* released nine advisories that address a total of 44 security issues in Audition, After Effects, InDesign Desktop, Substance 3D Designer, Substance 3D Stager, Substance 3D Modeler, Bridge, Lightroom Classic, and the DNG SDK. And finally, this week, the US Cybersecurity and Infrastructure Security Agency (CISA) published 15 *Industrial Control System (ICS)* security advisories to address vulnerabilities in products from Airleader (1 advisory), Hitachi (1 advisory), Siemens (8 advisories), ZOLL (1 advisory), AVEVA (2 advisories), ZLAN (1 advisory), and Yokogawa (1 advisory).
Editor's Notes
- Slide 1 of 2
Start planning the rollout of the SAP updates now; your ERP system owner isn’t going to let you just click deploy without testing, and these need to be put in place. With luck the Adobe updates are handled by creative cloud, so you just need to very they’re done. Ask your ICS team for relevance and deployment/mitigation plans for the updates. Best outcome, this is another tracking/verification task rather than a hands-on issue for you.
- Slide 2 of 2
The cost of patching continues to rise.
Slide 1 of 0- Slide 1 of 2
The Rest of the Week's News
Who Patches the Patches? Fortinet
Fortinet released security advisories on Tuesday, February 10, including a fix for CVE-2025-68686 (CVSS 5.9), which would allow a remote unauthenticated attacker to bypass Fortinet's existing patches for flaws known to be exploited in 2025 (CVE-2022-42475, CVE-2023-27997, and CVE-2024-21762). Two of the new advisories address high-severity flaws. CVE-2025-52436, CVSS score 8.8, allows an unauthenticated attacker to execute commands by crafting requests in Fortinet FortiSandbox 4.0, 4.2, 4.4.0 to 4.4.7, and 5.0.0 to 5.0.1, due to a cross-site scripting flaw created by improper neutralization of input during web page generation. CVE-2026-22153, CVSS score 8.1, allows an unauthenticated attacker to bypass LDAP authentication of Agentless VPN or FSSO policy under a specific LDAP server configuration, due to an authentication bypass by primary weakness vulnerability in FortiOS 7.6.0 to 7.6.4. The previous Friday, Fortinet also released a patch for FortiClientEMS before 7.4.5, addressing CVE-2026-21643 (CVSS 9.1), which allows an unauthenticated attacker to execute code or commands using crafted HTTP requests, due to an SQL injection flaw.
Editor's Notes
Fortinet released eight updates on Tuesday. Their PSIRT page has information for you to track affected products and versions. Make plans both to deploy the updates and to get on the latest supported versions for your Fortinet devices. These flaws are just too tempting to risk old versions, let alone deferred updates. Augment that with the scenario of updates to the update, which doesn’t include the old version you’re running. You don’t want to have to explain that after an incident.
Bitkom Study: German Companies Not Well-Prepared for Internet Outage
An act of sabotage in early January 2026 caused power outages in Berlin that lasted for days, leaving more than 100,000 people without electricity and affecting 2,000 companies. Dr. Ralf Wintergerst, president of the German digital association Bitkom, said "Hybrid attacks on Germany, which operate in a gray area between war and peace, are not a potential risk; they are a reality. Therefore, we must massively increase the resilience of the economy, government, and society." Bitkom commissioned a survey of 604 companies that have 10 or more employees in Germany, and the responses show that a majority of German companies are not confident they could maintain operations for more than 20 hours during an internet outage; five percent said they would likely need to shut down operations immediately. Just eight percent of companies responded that they could maintain operations for more than 48 hours. Attacks against energy supply, the financial and insurance sectors, and telecommunications and IT were most likely to disrupt the ability to maintain operations, according to those surveyed. Other indicated sectors for concern include water supply, transportation, and traffic.
Editor's Notes
- Slide 1 of 4
Cyber resilience, or critical infrastructure resilience in this case, has been a topic of discussion for decades; but here we are. The reality is that resilience comes at a cost to the company and most defer that risk to focus on market share and profitability. This report focuses on Germany, but it's likely true of every other country.
- Slide 2 of 4
It’s easy to assume your Internet connection will remain up during a utility outage, so all you need is to keep your facility online. But what if the path is severed? When is the last time you thought about path diversity or alternate ISPs? Now add to that the connection to your hosted and cloud services. Business continuity planning is more complicated these days, let alone testing said plans. It’s really easy to treat those as paper or other unimportant exercises; they are not. You may discover that being offline is better than attempting to failover to a low bandwidth backup connection. Make sure senior management is on board with the plan and impacts; they may have different expectations.
- Slide 3 of 4
Recent events such as alleged Russian cyberattacks against European power networks and the impact of ever stronger storms on power and telecoms infrastructure mean that all businesses need to view cyber resilience as a key factor in how they maintain doing business in the event of a major outage. A major outage of power, internet infrastructure, or telecom networks is increasingly a question of when and not if.
- Slide 4 of 4
This situation is not limited to Germany. Not only must one expect armed conflict to include attacks against electrical distribution, but one must anticipate covert attacks against electrical infrastructure in preparation for any potential armed conflict. The time to deal with this is before any armed conflict.
Slide 1 of 0- Slide 1 of 4
Dutch Mobile Phone Company Odido Discloses Data Theft
The Netherlands' largest mobile phone company has disclosed a data breach affecting as many as 6.2 million individuals. Odido says that on February 7, 2026, intruders downloaded a data file containing names, physical addresses, phone numbers, customer numbers, email addresses, account numbers, dates of birth, and passport and driver’s license information. The company has notified the Dutch Data Protection Authority (AP) and will contact affected customers via email or text message. Odido has roughly 7 million customers and has operated under several different names over the past few years, including T-Mobile Netherlands.
Editor's Notes
- Slide 1 of 3
Two questions for Odido: 1) Do you really need to keep all that PII? and 2) Is that really the best way to contact affected customers? We’re programmed these days to suspect and delete email and text messages, from online scams to phishing training.
- Slide 2 of 3
I’m wondering how effective the notification plan will be. There is a certain authority to messages from your carrier, but less so with all the spam these days. If you’re thinking of email or text for breach notification requirements, consider planning to use both to increase the likelihood the message gets through. You need to be prepared to mail physical statements where digital communication goes unanswered.
- Slide 3 of 3
If you do not retain it after it has served its purpose, you will not leak it.
Slide 1 of 0- Slide 1 of 3
Microsoft is Releasing Updated Secure Boot Certificates Ahead of June Expiration
Microsoft introduced Secure Boot in 2011 to "ensure only trusted, digitally signed software can execute ... by blocking untrusted code at the earliest stage of the boot process." The original Secure Boot certificates begin expiring in June 2026. Microsoft writes that they have "begun rolling out new certificates as part of the regular monthly Windows updates to in-support Windows devices for home users, businesses and schools with Microsoft-managed updates. Organizations also have the option to manage the update process themselves using their preferred management tools." The new certificates will be installed automatically for users who have configured their systems to allow Microsoft to manage Windows updates. In some cases, devices may require firmware updates from their manufacturers prior to installing the new certificates. Users are advised to "check their OEM support pages to ensure they have the latest firmware updates." Microsoft urges users to update to Windows 11, as devices running Windows 10 and other unsupported versions of the operating system will not be receiving new certificates. Devices that do not receive updates certificates before the end of June 2026 will continue to operate, but "will enter a degraded security state that limits its ability to receive future boot-level protections."
Editor's Notes
- Slide 1 of 2
These certificates were introduced with Windows 8 back in 2011. The update needs sufficient room in NVRAM to hold the certificates, and may require OEM firmware updates before they can be loaded. Dell has published a PowerShell command you can use to verify the new certificates are installed. Leverage it to verify your deployment process before you push it out enterprise wide.
- Slide 2 of 2
Given the amount of work involved to update one/both firmware and certificates, it’s likely that many small organizations will simply not perform the update. Here’s hoping that they previously handed off the update process to Microsoft managed tools.
Slide 1 of 0- Slide 1 of 2
Microsoft Introduces Windows Baseline Security and User Transparency and Consent
In a February 9 blog post, Microsoft introduced two initiatives intended to improve user security: "With Windows Baseline Security Mode, Windows will move toward operating with runtime integrity safeguards enabled by default. These safeguards ensure that only properly signed apps, services and drivers are allowed to run, helping to protect the system from tampering or unauthorized changes." Users and admins will have the option of overriding the protections if and when they find it necessary. "User Transparency and Consent [brings] a more consistent and intuitive approach to how Windows communicates security decisions." The feature will alert users when apps attempt to access "sensitive resources" including files, cameras, and microphones. Both features are part of Microsoft's Secure Future Initiative.
Editor's Notes
- Slide 1 of 3
A good security move by MSFT. It is likely to cause some issues early on, but with patience by users and IT staff, it has high likelihood to reduce the attack surface. Now if MSFT could only fix the patch management process...
- Slide 2 of 3
This feels like a good model for home and general office workers. Even so, you’re going to want to test this thoroughly. While users can override the protection, you’re going to need to know when you want to allow that and which apps are going to need exceptions. You may need different baselines for some user profiles.
- Slide 3 of 3
Safe by default should always be the preferred mode of operation. This is a significant change from Microsoft's historic preference for open and backwards compatible.
Slide 1 of 0- Slide 1 of 3
May 2025 ApolloMD Breach Affects More than 626,000 Individuals
Atlanta, Georgia-based ApolloMD has disclosed that a May 2025 ransomware attack resulted in the compromise of personal information belonging to 626,540 individuals. The company "provide[s] integrated, multispecialty physician, APC and practice management services" to more than 100 hospitals across the US. ApolloMD notified affected customers of the incident in September 2025, but did not inform the US Department of Health and Human Services Office for Civil Rights (HHS OCR) of the number of people affected until early February 2026. The intruders accessed information of individuals treated by doctors and practices served by ApolloMD; compromised data include names, birth dates, addresses, diagnoses, treatment information, dates of service, provider names, health insurance information, and Social Security numbers.
Editor's Notes
- Slide 1 of 2
Kudos for notifying affected customers in a timely fashion. A few points off for forgetting to notify the regulator. If you’re processing data with breach notification requirements, make sure those are kept updated and are part of your exercise. It’s better to ask them for help understanding the requirements and reporting process prior to a breach; it helps answer tricky questions in an audit. Beyond timeline, be aware of fines, penalties, and follow-up actions they will require.
- Slide 2 of 2
Anyone willing to bet that reliance on passwords was not implicated in this breach?
Slide 1 of 0- Slide 1 of 2
Volvo Employee Data Exposed in Conduent Breach
In a data breach notification filing with the Maine Attorney General's office, Volvo Group North America disclosed that the Conduent breach, which occurred in late 2024 and early 2025, exposed personal information of nearly 17,000 Volvo employees. Volvo Group North America manufactures commercial vehicles and heavy equipment, and passenger cars are manufactured by a separate division. Conduent detected the breach in January 2025; intruders had access to the systems of the benefits and back office outsourcing company starting in October 2024. Volvo's disclosure indicates that they learned company data were affected in the breach on January 21, 2026. Conduent has notified affected Volvo Group North America employees by mail, explaining that the incident involves " files associated with [their] current or former health plan." Recent reports indicate that the number of individuals believed to be affected by the Conduent breach has continued to grow. Numbers provided in filings with various US states suggest that tens of millions of individuals could be affected.
Editor's Notes
- Slide 1 of 2
A year to discover information is exfiltrated is unacceptable. Make sure you are detecting breaches in a timely fashion and also quickly determining what data is affected. Yes, that’s a tall order. Your employees and customers deserve it.
- Slide 2 of 2
A family member recently received a breach notification letter from Conduent. They don’t work for Volvo but received a letter nonetheless. So, the question: what was done to safeguard their PII/PHI in the year since the breach was discovered?
Slide 1 of 0- Slide 1 of 2