September 7, 2026
The Diff Is the Disclosure: MikroTik's Silent Patch Comes Apart
MikroTik RouterOS underwent a silent patch for SSH authentication bypass and RSA signature forgery bugs (CVE-2026-67276) with active exploitation since at least 2 September, and researchers reverse-engineered the fix with PoC code in six hours. Adobe Magento/Commerce hosts an unpatched zero-day RCE (StyleSmuggler) that gained a second Rust backdoor variant masquerading as fontconfig tools and beaconing to a fixed C2 address. JetBrains disclosed that attackers exploited CVE-2026-63077 in its own TeamCity server to breach Cadence infrastructure and steal source code, credentials, and user data dating to 8 August. Kimsuky's Operation GitPower now uses the OpenCode AI agent to mass-produce financial-themed decoys with anti-analysis evasion and GitHub/Pastebin C2 channels.