A mixed week: an actively-exploited MikroTik bug you should patch today, a WordPress plugin flaw a lot of sites still haven’t fixed, and a decent crop of releases for the virtualization and home automation crowd.
MikroTik RouterOS: “MikroTrick” SSH chain under active exploitation
Two chained bugs — an SSH public-key authentication bypass (CVE-2026-67276) and a crafted-username privilege escalation (CVE-2026-86060) — let an attacker who knows a valid username take full admin control of a RouterOS device with SSH exposed to the internet. CERT Polska has observed exploitation in the wild since September 2. MikroTik shipped fixes on September 3 in 6.49.21, 7.23.4, and 7.24.2. If you’ve got a RouterOS box with SSH reachable from the WAN side, patch now and check for unfamiliar accounts or scheduler/script entries while you’re in there.
MikroTik advisory
WordPress: a widely unpatched migration-plugin flaw, plus a core release and disclosure policy change
The All-in-One WP Migration and Backup plugin has a second-order SQL injection in its archive-restore flow (CVE-2026-19949, CVSS 8.8) affecting over 3 million sites. A fix landed in 7.110 back on August 20, but as of this week only around a third of installs have actually applied it — worth checking if you or anyone you administer runs this plugin. Separately, WordPress 7.1.1 is a bug-fix-only maintenance release due September 17, and the security team tightened its Vulnerability Disclosure Program guidelines on September 1 so low-impact, admin-only-role reports on third-party plugins are generally no longer accepted, freeing up review time for issues that actually matter.
Migration plugin vulnerability · Disclosure program update
Home Assistant 2026.9 released
This month’s release lets integrations share a single Modbus connection instead of fighting over the bus (handy if you’ve got more than one Modbus-based integration configured), adds active alerts and favorites to the Security dashboard, and makes charts screen-reader accessible. Weekly bug-fix patch releases are planned through September, usually landing on Fridays.
Home Assistant 2026.9 release notes
Incus 7.4 released
The LXC/VM manager many use as a lighter alternative to Proxmox picked up UEFI Secure Boot key management, “near-live” migration of containers between hosts, and burst I/O limits for disk and network devices, on top of a batch of Ceph and evacuation/migration fixes.
Incus 7.4 announcement
Kernel: the Rust “rnull” block driver closes in on feature parity
The Rust reimplementation of the null_blk benchmarking driver picked up FLUSH/FUA support, hardware queue configuration, fault injection, and max-IO-size options this cycle, bringing it close to parity with the C version. It’s a small driver, but it’s become the de facto test case for whether Rust is viable for real block-layer work in the kernel.
rnull driver coverage on LWN
Ubuntu security updates: kernel, OpenSSH, and friends
Canonical pushed a batch of security updates this week, including kernel fixes for 18.04/20.04 LTS and fixes across supported releases for rabbitmq-c, libssh2, SPICE vdagent, and OpenSSH. Nothing dramatic individually, but worth running through your usual apt update && apt list --upgradable pass if you haven’t already.
Ubuntu security notices
Leave a Reply