Costin Raiu

@craiu · Twitter · 2026-09-05 20:31 UTC

Heads up, there is a 1-day full MikroTik RCE chain against SSH being used in the wild. Patch was released yesterday, so if you have a MikroTik router with ssh open on the internet, it may already be compromised. Detection guidance and IOCs courtesy of @CERT_Polska_en https://cert.pl/en/posts/2026/09/vulnerabilities-in-mikrotik-routeros-actively-exploited/