Week ending February 20, 2026

The ICT sector in early 2026 is marked by growth in spending, critical infrastructure upgrades (AI and networking), expanding regulatory focus on security and sovereignty, and breakthrough innovations in AI hardware and autonomous systems. These developments are reshaping how digital services are delivered, consumed, and regulated — unlocking efficiencies and capabilities for both businesses and societies, while also creating new policy, investment, and competitive dynamics.

What moved this week wasn’t “one big new thing” — it was a set of stack upgrades across patching, critical infrastructure resilience, spyware exposure, and sovereignty-driven security rules.

Exploited-vulnerability response accelerated (patch-or-get-hit)

CISA added multiple actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog (Feb 17), a signal that “patching cadence” is now a frontline control, not a best-practice nice-to-have.
Chrome shipped a security update for a high-severity flaw under active exploitation (reported Feb 11; pushed in the following days), reinforcing the “browser as battlefield” reality.
Microsoft’s February security release (Patch Tuesday) continued to emphasize exploited bugs (the backlog organizations must burn down).

Systems upgrade: vulnerability management is shifting toward continuous exposure management (asset visibility → prioritization → rapid patching) instead of periodic patch cycles.

Critical infrastructure took visible hits (availability is the new headline)

Germany’s national rail operator’s booking/info systems were disrupted by a DDoS attack and later restored, with the company citing effective countermeasures (Feb 18).

Systems upgrade: resilience investments are increasingly about service continuity (traffic-shaping, scrubbing, redundancy, comms playbooks) — because even “non-destructive” attacks create public disruption and economic cost.

“Security of devices” expanded beyond IT into cars, telecom, and edge systems

Poland barred Chinese-made vehicles from entering military facilities over concerns that onboard sensors/infotainment could collect sensitive data; they also restricted connecting official phones to certain vehicle systems (Feb 18).
In parallel, CISA messaging pushed organizations toward better lifecycle tracking and asset control (e.g., OpenEoX for end-of-support / end-of-life visibility).

Systems upgrade: cybersecurity scope is expanding into cyber-physical supply chain governance: “What devices can enter sensitive places?” + “Do we know what’s supported vs. end-of-life?” Spyware exposure + accountability pressure rose

Reuters reported on an Amnesty finding that a prominent Angolan journalist’s phone was infected with Predator spyware via a social-engineering link, highlighting ongoing risks to civil society and press freedom (reported Feb 18).

Systems upgrade: the “human layer” (messaging apps + link hygiene + device hardening) is now inseparable from governance and rights — spyware is treated as a geopolitical/security instrument, not just crimeware.

Identity and phishing remained the primary breach pathways

Incident-response analysis continued to show most breaches hinge on identity weaknesses (stolen credentials, MFA bypass, over-permissioned cloud identities) and faster attacker timelines.
Multiple breach disclosures/data-leak stories this week reinforced the pattern: phishing + third parties + credential abuse translate into real-world consumer exposure.

Systems upgrade: “identity is the perimeter” is no longer a slogan — it’s the dominant incident root cause in modern environments (SaaS + cloud + contractors).

Impacts (what this week’s signals mean)

Operational risk is rising: DDoS and service disruption are now “public-facing” failures that directly affect trust, commerce, and mobility.
Cyber sovereignty is hardening: device-origin and supply-chain rules (like restrictions on connected vehicles) will spread to more sectors and geographies.
The attacker advantage is speed: exploited vulns + identity abuse compress response windows from days to hours.

What people can do where they are now (practical, high-leverage)

For households / individuals

Update browsers and OS promptly (especially Chrome/Edge/Windows) — exploited bugs are being used “in the wild.”
Turn on phishing-resistant MFA where available (passkeys/security keys), and treat unexpected links/messages as hostile (spyware cases still start with a click).

For organizations / communities

Run a weekly “Top 10 exposed assets” review: internet-facing systems, cloud IAM, privileged accounts, VPNs, email security.
Adopt a KEV-driven patch SLA (e.g., 48–72 hours for exploited items) and measure compliance.
Tighten identity hygiene: least privilege, remove standing admin rights, monitor token/session abuse, and lock down SaaS admin consoles.
For critical services (transit, utilities, hospitals): rehearse DDoS continuity playbooks (alternate comms, “graceful degradation,” vendor escalation paths).

For local government / public infrastructure owners

Create “device entry rules” for sensitive sites (what connected devices/vehicles can connect to networks or cross perimeters) and require lifecycle inventories (what is end-of-support).