MikroTik SSH RCE chain mass-exploited in the wild since Sept 2, one day before the patch
moyix · x · 2026-09-06
- Security researcher craiu warns of a full 1-day RCE chain against MikroTik routers targeting SSH, now being massively exploited in the wild.
- The timeline is startling: exploitation began September 2, while patches only shipped September 3 — meaning attacks actually preceded the patch release, not just followed it.
- Anyone running an internet-facing MikroTik router with SSH open should assume possible compromise if unpatched. Detection guidance and IOCs are provided courtesy of CERT Polska.
More from Safety
- Typosquatted Blender MCP Repo Hit 958 Stars in Days and Silently Ran Malware — Promptmethus · 2026-10-23
- PHP, certificates, railways: a 48-hour wave of hacking incidents unpacked — David Ondrej · 2026-10-23
- Prompt injection scanners should be positional, not phrasal: same string, different blast radius — mrpkk · 2026-10-23
- Beff Jezos calls for a 'cyber immune system' of constantly adaptive agents — beffjezos · 2026-10-23
- Security expert: cybercriminals aren't engineer-tier, AI-native crime syndicates will take time — joshua_saxe · 2026-10-23
- AI safety researchers argue even finance-grade governance may not be enough for AI — geoffreyirving · 2026-10-23