---
title: "Security digest: February 17, 2026"
url: https://erroneo.us/security/2026-02-17/
description: "February 17, 2026 vulnerability digest: 4 CISA KEV additions (Google, Microsoft, Synacor, TeamT5); 5 critical advisories (npm, Composer (PHP)). What to…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-02-17
date_modified: 2026-02-17
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: February 17, 2026

4 known exploited (cisa kev) additions and 5 critical advisories.

## Take stock

- Do you run any of these? Google Chromium, TeamT5 ThreatSonar Anti-Ransomware, Synacor Zimbra Collaboration Suite, Microsoft Windows. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-03-10.
- npm: 4 critical advisories ( openclaw , @openclaw/nextcloud-talk ). Check with npm audit (or: npm ls <package>) .
- Composer (PHP): 1 critical advisory ( pterodactyl/panel ). Check with composer audit .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Known exploited (CISA KEV)

- [CVE-2026-2441](https://erroneo.us/security/cve/CVE-2026-2441/index.md) Google Chromium: Google Chromium CSS Use-After-Free Vulnerability (CISA due 2026-03-10)
- [CVE-2024-7694](https://erroneo.us/security/cve/CVE-2024-7694/index.md) TeamT5 ThreatSonar Anti-Ransomware: TeamT5 ThreatSonar Anti-Ransomware Unrestricted Upload of File with Dangerous Type Vulnerability (CISA due 2026-03-10)
- [CVE-2020-7796](https://erroneo.us/security/cve/CVE-2020-7796/index.md) Synacor Zimbra Collaboration Suite: Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery Vulnerability (CISA due 2026-03-10)
- [CVE-2008-0015](https://erroneo.us/security/cve/CVE-2008-0015/index.md) Microsoft Windows:  Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability (CISA due 2026-03-10)

## Critical advisories

- [CVE-2026-28472](https://erroneo.us/security/cve/CVE-2026-28472/index.md) OpenClaw's gateway connect could skip device identity checks when auth.token was present but not yet validated — npm openclaw < 2026.2.2 → 2026.2.2
- [CVE-2026-28474](https://erroneo.us/security/cve/CVE-2026-28474/index.md) Nextcloud Talk allowlist bypass via actor.name display name spoofing — npm @openclaw/nextcloud-talk <= 2026.2.2 → 2026.2.6
- [CVE-2026-26016](https://erroneo.us/security/cve/CVE-2026-26016/index.md) Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization — Composer (PHP) pterodactyl/panel < 1.12.1 → 1.12.1
- [CVE-2026-28454](https://erroneo.us/security/cve/CVE-2026-28454/index.md) OpenClaw has a potential access-group authorization bypass if channel type lookup fails — npm openclaw < 2026.2.1 → 2026.2.1
- [CVE-2026-28446](https://erroneo.us/security/cve/CVE-2026-28446/index.md) OpenClaw has an inbound allowlist policy bypass in voice-call extension (empty caller ID + suffix matching) — npm openclaw < 2026.2.2 → 2026.2.2

---
Source page: https://erroneo.us/security/2026-02-17/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt