> InfoSec News Nuggets 02/11/2026

SSHStalker Botnet Uses IRC C2 to Control Linux Systems via Legacy Kernel Exploits Researchers have disclosed a new Linux botnet dubbed SSHStalker that leverages the old Internet Relay Chat (IRC) protocol for command‑and‑control, breathing fresh life into legacy communications channels for modern mass compromise. Initial reporting suggests the botnet scans SSH endpoints to find vulnerable systems and then installs its C2 payload, blending decades‑old techniques with current automation to stealthily spread. Some estimates say nearly 7,000 systems have already been infected, making it a non‑trivial emerging malware operation. This development underscores the persistent efficacy of overlooked protocols and legacy attack paths in expanding botnet reach.   170+ SolarWinds Help Desk Installations Vulnerable to RCE Attacks Exposed Online Over 170 SolarWinds Web Help Desk deployments are still vulnerable to a critical remote code execution flaw that CISA flagged as actively exploited, despite vendor patches being available. Remaining exposed instances leave IT help desk platforms open to instrumented exploit kits that can establish initial access and potentially pivot deeper into networks. The ongoing exploitation trend underscores attackers’ interest in targeting management infrastructure with broad internal visibility and privileged access. IT teams should inventory affected systems and apply updates or mitigations without delay to avoid compromise.   Malicious 7-Zip site distributes installer laced with proxy tool A fake 7‑Zip download site has been discovered distributing a trojanized installer that converts unsuspecting user systems into residential proxy nodes for malicious use. Users grabbing what appears to be the legitimate archiving tool end up unwittingly installing software that channels their network traffic for adversarial purposes, eroding trust in widely used open‑source distribution sites. This type of supply‑chain manipulation shows how easily popular utilities can be weaponized, especially when hosted on unofficial mirrors or third‑party download aggregators. It also highlights the need for integrity checks and verified download sources.   Patch Tuesday: Adobe Fixes 44 Vulnerabilities in Creative Apps Adobe’s February 2026 Patch Tuesday release includes fixes for 44 vulnerabilities across its suite of creative applications, some of which could allow code execution or privilege escalation. Regular and comprehensive patch cycles such as this one play a critical role in reducing the exposure window for both targeted and opportunistic attacks. Security teams should validate deployment of these updates across all Adobe toolchains and integrate patch status into continuous risk metrics. Timely application of vendor patches remains one of the most effective defenses against exploitation.   U.S. CISA adds SmarterTools SmarterMail and React Native Community CLI flaws to its Known Exploited Vulnerabilities catalog The US Cybersecurity and Infrastructure Security Agency expanded its Known Exploited Vulnerabilities catalog to include multiple flaws in SmarterTools SmarterMail and the React Native Community CLI, recognizing active exploitation. Inclusion in the KEV list typically forces federal agencies and others to prioritize mitigation efforts within tight timelines, reflecting real exploitation risk. These additions reinforce the persistent scourge of vulnerabilities in widely used messaging and development ecosystems and the need for vigilant patch management and supply chain oversight.   Risky Bulletin: Chinese cyber-spies breached all of Singapore’s telcos Singapore’s Cyber Security Agency disclosed that a China‑linked group successfully breached all four of the country’s major telecom providers, evicting threat actors after an extended 11‑month investigation. This widespread compromise highlights the sophisticated and persistent nature of state‑linked cyberespionage targeting critical communications infrastructure. Although customer services were not significantly disrupted, the incident raises concerns about long‑term footholds and covert access paths deep within core network environments. Operators globally should consider advanced threat hunting and segmentation strategies to mitigate similar reconnaissance and persistence operations. The post InfoSec News Nuggets 02/11/2026 appeared first on AboutDFIR - The Definitive Compendium Project.