Daily brief · 2026-09-25 · updated 2026-10-12

4 Critical Security Fixes You Need Today

▶

MikroTik RouterOS

Threat actors are actively exploiting a chain of MikroTik RouterOS vulnerabilities called MikroTrick, gaining unauthenticated administrative control over internet-exposed SSH services. Attackers have been targeting RouterOS devices accessible from the internet in recent days. By chaining two vulnerabilities together, they achieve full device control via SSH without any credentials. Patches have been released to prevent these attacks.

Why it matters: This grants attackers unauthenticated remote administrative control over internet-exposed MikroTik RouterOS devices.

What to do: Immediately patch RouterOS to the latest September 2026 release and disable SSH internet exposure unless absolutely critical. Audit your RouterOS devices for compromise indicators.

CVEs: CVE-2026-67276, CVE-2026-86060, CVE-2026-67279

Bitget cryptocurrency exchange

The Bitget cryptocurrency exchange experienced a backend compromise resulting in approximately $351.6 million in unauthorized transfers from hot wallets, while cold wallets and customer balances remained secure. At 18:31 UTC on September 24th, 2026, Bitget’s security systems detected unauthorized transfers involving a limited set of hot wallets. The attacker compromised backend systems to spoof transaction data rather than stealing private keys. Cold wallets remain completely secure and unaffected.

Why it matters: The core issue is $351.6 million in unauthorized transfers from hot wallets while maintaining customer balance accuracy.

What to do: Verify your customer balances directly with Bitget and monitor for any unauthorized account activity. Review your API key permissions immediately.

MikroTik RouterOS, Microsoft SharePoint

CISA added two vulnerabilities to the Known Exploited Vulnerabilities catalog on September 25th, 2026, confirming active exploitation: MikroTik RouterOS improper workflow enforcement and Microsoft SharePoint code injection. CVE-2026-67279 in MikroTik RouterOS was added to CISA’s KEV on September 25th. CVE-2026-65660 affecting Microsoft SharePoint was added the same day. Both vulnerabilities are confirmed to be actively exploited in the wild.

Why it matters: CISA’s confirmation means both vulnerabilities are being actively exploited in real-world attacks right now.

What to do: Immediately prioritize patching CVE-2026-67279 and CVE-2026-65660 since both are confirmed actively exploited.

CVEs: CVE-2026-67279, CVE-2026-65660

Microsoft SharePoint

Threat researchers observed active two-stage exploitation of CVE-2026-65660 targeting Microsoft SharePoint deployments with anonymous viewing enabled, delivering webshell backdoors through quote injection. On September 24th, 2026, researchers captured 12 exploitation requests targeting this vulnerability on a SharePoint honeypot. The attacks use an anonymous delivery pattern to bypass authentication. This allows attackers to deploy webshell backdoors on vulnerable SharePoint instances.

Why it matters: Unauthenticated remote code execution through a webshell backdoor allows attackers to take full control of SharePoint instances without needing any credentials.

What to do: Patch CVE-2026-65660 immediately and disable anonymous viewing on your SharePoint deployments unless absolutely required. Audit your SharePoint instances for webshell artifacts at /_layouts/15/sphealth.aspx.

CVEs: CVE-2026-65660

Tags: mikrotik-routeros, bitget-cryptocurrency-exchange, mikrotik-routeros-microsoft-sharepoint, microsoft-sharepoint