If you read nothing else
- Install February's Windows updates and restart. Six of the flaws were already under attack.
- Ask your IT provider whether any remote support or help desk tool on your network is patched. Ransomware crews went after them.
- Write down how you would take payments for a week if your processor went dark.
Six things from February. Each one says what happened, what it means for a small business or a small defense supplier, and one thing to do about it.
1. Microsoft fixed six flaws that were already being used
Microsoft's February Patch Tuesday fixed 58 flaws, including six that were actively exploited and three that were publicly disclosed before a fix existed. Source: BleepingComputer. CISA added all six, CVE-2026-21510, CVE-2026-21513, CVE-2026-21514, CVE-2026-21519, CVE-2026-21525 and CVE-2026-21533, to its Known Exploited Vulnerabilities catalog on February 10. Source: CISA KEV catalog.
What this means for you: attackers had working exploits for Windows and Office before most offices installed the fix.
Do this: on every Windows PC, open Settings, then Windows Update, install, restart, and check again until it says you are up to date.
2. Remote support tools became the way in
On February 13, CISA added CVE-2026-1731, a command injection flaw in BeyondTrust Remote Support and Privileged Remote Access, to its exploited list with a February 16 deadline for federal agencies, and marked it as known to be used in ransomware campaigns. CISA also added two SolarWinds Web Help Desk flaws, CVE-2025-40551 on February 3 and CVE-2025-40536 on February 12. Source: CISA KEV catalog. NVD describes the BeyondTrust flaw as a pre-authentication remote code execution bug. Source: NVD record.
What this means for you: the tools that let your IT provider into your computers can let an attacker in the same way.
Do this: ask your IT provider, in writing, which remote support and help desk tools touch your network and the date each one was last patched.
3. CISA ordered emergency action on Cisco SD-WAN
On February 25, CISA issued Emergency Directive 26-03, ordering federal agencies to inventory their Cisco SD-WAN systems, collect forensic evidence, apply updates and look for compromise. Source: CISA ED 26-03. The main flaw, CVE-2026-20127, is an authentication bypass rated 10 out of 10 for severity. Source: Infosecurity Magazine.
What this means for you: the boxes that manage your network are a favorite target, because one of them controls everything behind it.
Do this: if you or your provider run Cisco SD-WAN, confirm it was patched in late February and that someone checked it for signs of compromise.
4. A year-old VMware flaw turned up in ransomware attacks
On February 4, CISA updated its catalog entry for CVE-2025-22225, a VMware ESXi flaw, to show it is used in ransomware campaigns. Broadcom patched it in March 2025. Source: Help Net Security.
What this means for you: a patch that is a year old only protects you if someone installed it.
Do this: if you run VMware ESXi servers, ask for proof that the March 2025 security patches are installed on every host.
5. A payment processor outage stopped card payments
A ransomware attack on BridgePay, a payment gateway, caused widespread U.S. payment outages and left some businesses and local governments unable to take cards for a time. BridgePay said no card data was compromised. Source: eSecurity Planet, February 9.
What this means for you: your vendor's outage is your outage, even when none of your own systems were touched.
Do this: write a one page plan for taking payments and paying staff if your processor or bank portal is down for a week.
6. A trusted software update was hijacked
Notepad++, a popular text editor, said attackers hijacked its update service from June 2025 until December, sending selected users to malicious downloads. Researchers linked the activity to a likely Chinese state-sponsored actor. Source: The Record. CISA added the updater flaw, CVE-2025-15556, to its exploited list on February 12. Source: CISA KEV catalog.
What this means for you: the update button is only as safe as the server behind it.
Do this: update Notepad++ to the current version from its official site, and keep a list of every program your staff installed on their own.
Not sure where you stand? Cyber Grants Alliance offers in-kind CMMC Level 1 and CMMC Level 2 gap assessment grants, at no cost to you. See every program on Grant Programs.