MEGANews. Cамые важные события в мире инфосека за сентябрь

September brought a wave of major security news. CERT Polska disclosed six RouterOS flaws in MikroTik routers, including a chain dubbed MikroTrick that combines CVE-2026-67276 and CVE-2026-86060 to grant unauthenticated administrative access over an exposed SSH service; attacks began on September 2, 2026, and additional bugs (CVE-2026-67277, CVE-2026-67278, CVE-2026-67279, CVE-2026-67281) allow memory leaks, reboots, certificate forgery and credential theft via WebFig. MikroTik has shipped fixes in RouterOS 6.49.21, 7.23.4, 7.24.2 and 7.25beta3. Separately, Microsoft's September Patch Tuesday fixed a record 966 vulnerabilities across its own products (723 in Windows, 222 in Office), including two actively exploited zero-days, with the company blaming AI-assisted bug hunting for the surge. The DataSuckers group claimed to have breached travel operator Tez Tour, defacing its site and claiming theft and destruction of hundreds of millions of booking and payment records, though Tez Tour says its ERP system and active bookings were unaffected. ShinyHunters also claimed to have compromised FBI systems through an unknown Oracle PeopleSoft zero-day, among other notable events of the month.