Vulnerabilities
CERT Polska found attackers chaining two MikroTik RouterOS flaws to take full administrative control of routers with SSH exposed to the internet, no password required. MikroTik shipped fixes, but SANS warns a patched device may already be owned: assume compromise and hunt.
Vulnerabilities & Patching
Cisco disclosed CVE-2026-20212, a CVSS 9.8 flaw that lets an unauthenticated remote attacker run code as root on 10 Silicon One-based Nexus 9000 switches, and shipped an IOS XR hardening release bundling seven CVEs, two rated 9.8, with no workaround for any version.
Supply Chain Attack
Softaculous has reconstructed the 33-hour BGP hijack that rerouted its traffic in late August. Attackers used a valid TLS certificate for Softaculous domains to serve a malicious Virtualizor update, establishing persistent root access on the hosts that installed it during the window.
Nation-State Cyber Threats
Sygnia says the China-nexus espionage actor Fire Ant has pushed past VMware hypervisors into the network authentication and logging plane, compromising Cisco IOS XR routers, TACACS servers, and Linux management hosts to harvest credentials and suppress the telemetry defenders rely on.
Vulnerability Research
VulnCheck found two undocumented factory implants, SPEAKINGSTONE and DARKLANTERN, in firmware for ZBT routers sold worldwide as white-label products. Both hand an unauthenticated remote attacker root command execution. Here is what network defenders should verify.
Vulnerabilities & Patching
Cloud Software Group patched CVE-2026-19490, a critical authentication bypass in NetScaler ADC and Gateway rated CVSS 9.3 and reachable by an unauthenticated attacker over the network. No exploitation is confirmed yet, but these perimeter appliances rarely stay quiet.
Vulnerabilities
Wireshark 4.6.8 lands with fixes for 28 vulnerabilities and 25 bugs. Every one of the 28 is a dissector or file-parser crash, not remote code execution, but because analysts open untrusted captures on their own machines, patching and sandboxing both matter.
Vulnerabilities
Fortinet patched high-severity authentication flaws in FortiWeb and FortiManager. One lets a remote attacker log in with random usernames and passwords; the other lets an attacker impersonate any FortiGate managed by FortiManager. No active exploitation is reported — patch now.
Vulnerabilities
CISA added Progress Kemp LoadMaster's CVE-2026-8037 — a CVSS 9.6 command injection flaw — to its Known Exploited Vulnerabilities catalog after 792 documented exploit attempts. Federal agencies have until August 10 to patch. Here is how to find, fix, and verify your deployments.
Vulnerabilities
Cisco's newest hardening release patches 12 Catalyst SD-WAN and IOS XE flaws — three of them rated CVSS 9.9 and a fourth at 9.8. Cisco says none are exploited yet, which makes this a patch-priority call: take the criticals first, schedule the rest by exposure.
Vulnerabilities
Static credentials shipped inside a firewall manager handed attackers a built-in way in. Cisco has released hot fixes for Secure Firewall Management Center, and the zero-day is already on CISA's exploited-vulnerabilities list.
Vulnerabilities
From advisory to public PoC — Check Point SmartConsole in the spotlight this week.