Three separate attack chains with active exploitation hit the open internet in the past seven days. One targets network routers that expose SSH on the public net. One abuses Magento's payment failure email pipeline to plant a Rust backdoor. One gives remote attackers root on a monitoring platform run by managed service providers. They share the same fundamentals, and reading the disclosures side by side tells you more about how patching actually works than any single incident could.
The MikroTrick chain
On September 7, CERT Polska disclosed six MikroTik RouterOS vulnerabilities and named the combined attack chain MikroTrick. Two of the flaws carry CVSS scores of 9.2. CVE-2026-67276 is an SSH user impersonation bug that lets an attacker forge a valid key if they know the authorized user's RSA modulus. CVE-2026-86060 is a privilege escalation bug triggered by a crafted SSH username. Chained, they let a remote unauthenticated attacker take full control of the router. The rest of the set is equally unkind. CVE-2026-6727 is a kernel memory disclosure and denial of service flaw scoring 8.8 that needs no authentication, and CVE-2026-67281 is an 8.7 file read through the WebFig management interface that can pull root-owned config files containing credentials.
MikroTik patched all six in RouterOS 6.49.21, 7.23.4, and 7.24.2. The administrator's task is clear: fix the router, then verify that the router has not been handled before the fix landed.
What bothers me more is the disclosure sequence. MikroTik shipped a security update with version numbers but without enumerating the flaws or publishing CVEs. CERT Polska had to reverse engineer the patch and rebuild the vulnerability list. The team used GPT-5.5-cyber and GPT-5.6-sol models to do that work. Whatever you think of AI-assisted vulnerability research, the result is public, and the exploit development community now has what it needs. Active exploitation reaches back to at least September 2, which means these flaws were used as zero-days against unpatched gear. Anyone who delays this patch is doing so with full knowledge.
The exposure is not abstract. Shadowserver counts more than 122,500 MikroTik devices with SSH reachable on the internet. If you run one of those, you are already being scanned. SSH and WebFig should never sit open to the whole internet on a router you care about, because attackers are using that window to test an exploit chain that is about to become widely available.
The artifacts CERT Polska lists are concrete. Attackers tied to the IP addresses 82.192.72.4 and 103.102.31.18 left log lines such as "login failure for user -2 via ssh", "user added by ssh:-2@", and a new account named "ops". If you see those strings, treat the unit as compromised. Their absence does not clear anything, because the attackers who moved to later stages tend to hide better.
Adobe Commerce gets a backdoor through failed payment emails
Adobe Commerce and Magento have their own incident, and the delivery method is creative. Sansec calls the vulnerability StyleSmuggler. The flaw allows PHP injection into Magento's template system, and it slips past filters by hiding code in the "style" properties of the failure report. The first stage injects PHP through a generated failure report, then Magento itself executes that code when it generates a payment transaction failed reminder email or when the email delivery fails. No user interaction is required.
Sansec found the campaign on September 4 at 22:40 UTC and reproduced the chain on a clean installation within hours. Magento versions 2.4.7, 2.4.8, and 2.4.9 are affected. Applying the July and August 2026 patches does not help, because neither includes a fix for this vector. Adobe's scheduled patch batch ships on September 8, which is today, and a statement from the company remains unclear on whether StyleSmuggler is inside it.
Successful attacks install a Rust backdoor. The implant disguises itself with process names, first appearing as [kworker/u:8:0] and then as fc-cache in a version that emerged on September 6. It hides command and control traffic inside NTP server replies, so an outward look at your network shows nothing but UDP port 123. Once connected, the backdoor reports the hostname, username, OS version, memory, disk use, uptime, and whether the process has root. It is a clean persistence channel that gives an operator very little to see.
As an administrator, the most visible signal is a flood of failed payment emails. Sansec says legitimate declined payments can generate the same notices, so you treat bursts as something to investigate, not as proof. But you should look at why Magento is sending that volume of failure emails at all.
N-central: a maximum score, already under fire
The third event is surgical and severe. On September 6, N-able released a hotfix for CVE-2026-86218, a pre-authentication remote code execution flaw in N-central that leads to root access. It carries the maximum CVSS score of 10.0. Huntress observed attackers breaking into a production N-central server in August, and the vendor has now confirmed that the vulnerability was exploited in the wild before a patch existed. N-able's advisory is blunt about the timeline: unlike earlier vulnerabilities, this one was already under attack.
Every on-premises N-central build before version 2026.3.1.14 is vulnerable. Hotfix 3 from August does not address this vector, so you must go to 2026.3 Hotfix 4. The observed intrusions used unauthorized Cloudflare tunnels to keep access alive and to bypass perimeter monitoring. If you manage N-central for customers, the exposure is multiplied across every poller that connects to it.
The pattern that should decide your next hour
The common thread is that all three incidents were exploited before the general patch cycle caught up. The sequence is worth naming. The vendor ships a file, the adversary ships a payload, and the administrator is left to close the gap between the two.
MikroTik did not enumerate what it fixed, so researchers had to map the patches by hand, adding time to the window in which operators did not know what they were fixing. Adobe's routine calendar may or may not have brought a fix for StyleSmuggler even though Sansec confirmed exploitation began on September 4. N-able shipped a hotfix for a flaw that Huntress had seen used in August. None of these vendors is the villain here; they are just operating inside the same pressure system you are. But the lesson is that patch notes matter as much as the patch.
Do the practical work now. Trim the management interfaces you leave exposed, because the 122,500 device count from Shadowserver shows that attackers can enumerate them faster than you can secure them. Search your router logs for the account names and SSH markers that CERT Polska published. Pull the payment email volume for your Magento store and look for unexpected f-cache processes on the host. For N-central, update to 2026.3 Hotfix 4 today. There is no reason to wait for next week's maintenance window, since the vulnerability data and the exploit chains are already in the open.