Week in review: Linux rootkit deployed on F5 BIG-IP APM devices, Cisco FMC bugs exploited

Security teams face a mix of active intrusions and emergency patches, highlighted by a new Linux rootkit discovered on compromised F5 BIG-IP APM devices that conceals its web shell in memory rather than on disk. Active exploitation continues for critical authentication bypass flaws in Cisco Secure Firewall Management Center, identified as CVE-2026-20079 and CVE-2026-20316.

Updates were also released to address newly exploited zero-day vulnerabilities in Google Chrome and N-able N-central, while researchers detailed an "MikroTrick" exploit chain targeting unauthenticated MikroTik RouterOS devices.