A zero day vulnerability is an unpatched security flaw that attackers actively exploit before vendors release a fix. This week, CISA confirmed active attacks on MikroTik RouterOS, Cisco SD-WAN Manager, and Citrix NetScaler, putting manufacturers and professional services firms at immediate risk of remote access, root compromise, and data theft.
September 30th, 2026 brings urgent security updates for small business owners. CISA has warned of a critical vulnerability in MikroTik RouterOS (CVE-2026 series) that allows attackers to execute remote code with administrator privileges. The flaw is being actively exploited in the wild, and businesses using MikroTik routers must update immediately.
Google released Chrome version 154.0.8037.92/.93 addressing 32 security vulnerabilities, including one critical and multiple high-severity flaws affecting V8, ANGLE, GPU, WebGPU, Bluetooth, Passwords, and UI components across Windows, macOS, and Linux.
Cisco issued emergency updates for a critical zero-day (CVE-2026-76504, CVSS 9.8) in Catalyst SD-WAN Manager that allows unauthenticated attackers to bypass authentication and gain root access. Active exploitation is confirmed with no workaround available.
Google's Mandiant team reports two critical Citrix NetScaler zero-day vulnerabilities being actively exploited to deploy web shells and gain root access. Attacks have affected organizations in North America and Europe across government, financial services, technology, education, legal, and professional-services sectors.
Microsoft has identified a phishing campaign distributing fake Zoom and PDF installer files that deploy legitimate remote management tools (MSP360 and ScreenConnect). The campaign uses meeting invitations, document requests, software updates, RSVP cards, job offers, and delivery notices as lures to gain remote control of business computers.
Glow Labs research reveals AI coding agents inadvertently leaked 13,000+ internal screenshots from 300+ organizations across 900+ public GitHub repositories. The exposed data includes credentials, bank accounts, internal system screenshots, and proprietary information from cloud, healthcare, fintech, government, and Fortune 500 companies.
The Aurora ransomware group published 1.707 TB of data stolen from Buford-Thompson Company, a Texas construction contractor. The breach exposed five years of W-2 files (2021-2025) with Social Security numbers in plaintext for 350+ employees, complete Frost Bank infrastructure including four account numbers and ACH routing credentials, 9.3 GB of attorney-client privileged litigation files, 36+ active school construction project details with complete bid and pricing data, 2,000+ donor records from Human Services Campus nonprofit, QuickBooks files from Along Side Ministries, and Thompson family personal financial records.
Key recommendations: Apply all vendor security updates immediately, especially for MikroTik, Cisco SD-WAN, and Citrix NetScaler systems. Verify all software downloads directly from vendor websites rather than email links. Implement policies restricting what data AI development tools can access. Maintain offline backups and enforce multi-factor authentication across all systems.
Which zero day vulnerability affects your business infrastructure?
Four zero day vulnerabilities are under active attack right now. CISA warns that MikroTik RouterOS (CVE-2026 series) allows attackers to execute remote code with admin privileges on routers. Cisco's Catalyst SD-WAN Manager (CVE-2026-76504, CVSS 9.8) bypasses authentication entirely with no workaround available. Google's Mandiant team reports Citrix NetScaler zero days already deploying web shells in financial services and government networks. Your single most important action: verify your device inventory this week. Check which routers, SD-WAN appliances, and load balancers your firm uses. Then patch immediately from official vendor websites, not email links.
Key takeaways
- MikroTik, Cisco, and Citrix zero days are actively exploited right now. Patch routers and SD-WAN equipment immediately from official vendor sites.
- Microsoft reports phishing campaigns using fake Zoom and PDF installers to deploy remote access tools like ScreenConnect. Verify software downloads with your IT team before installing.
- Citrix attacks already compromised financial services and professional services organizations across North America and Europe. If you use Citrix NetScaler, contact your vendor today.
- Maintain offline backups and enforce multi-factor authentication now. These attacks target authentication mechanisms specifically.
Frequently asked questions
What is a zero day vulnerability and why should I care?
A zero day is a security flaw that vendors do not yet have a patch for, but attackers are already exploiting it in the wild. Your business cannot fix it through normal patching, so attackers can gain root access to your routers, firewalls, and servers. This week's zero days in MikroTik and Cisco affect core network infrastructure that handle all your traffic.
Do I need to replace my MikroTik router or Cisco SD-WAN system?
No. MikroTik and Cisco have released patches for their respective zero days. Update your devices immediately from the official vendor website or console, not through email links. If you cannot patch within 24 hours due to operational constraints, isolate affected devices from critical systems and monitor them closely.
How do I know if my business was hit by the phishing campaign with fake Zoom installers?
Check your email for recent meeting invitations, document requests, or software update notices that asked you to install Zoom or PDF tools. If anyone installed software from an email link rather than directly from zoom.com or adobe.com, your IT team should scan those machines for ScreenConnect or MSP360. Ask your IT provider to audit installed remote access tools.
Should I be worried about the Buford-Thompson ransomware breach data leak?
Yes, if your firm stores W-2s, bank credentials, or construction bid data. The Aurora group published 1.707 TB including Social Security numbers, ACH routing numbers, and project pricing details. Review your backup strategy and ensure sensitive files are encrypted at rest and offline backups cannot be accessed by attackers who compromise your network.
Sources
- https://www.bleepingcomputer.com/news/security/cisa-warns-of-critical-pre-auth-rce-flaw-in-mikrotik-routeros/
- https://cybersecuritynews.com/chrome-update-with-32-security-fixes/
- https://www.bleepingcomputer.com/news/security/cisco-warns-of-new-sd-wan-authentication-bypass-zero-day-exploited-in-attacks/
- https://cybersecuritynews.com/citrix-0-day-vulnerabilities-webshells/
- https://cybersecuritynews.com/remote-access-tools/
- https://cybersecuritynews.com/ai-coding-agents-leak-internal-screenshots/
- https://www.ransomware.live/id/QnVmb3JkLVRob21wc29uIENvbXBhbnksIExUREBhdXJvcmE=
Keep reading
Produced with AI from TC3's daily cyber briefing video. Not individually reviewed before publishing; questions go to a human at [email protected].