Daily Cyber Threat Brief — September 14, 2026: MikroTik RouterOS

September 14, 2026 | Cyber News | Network Security

MikroTik RouterOS: patching and compromise review belong together

Internet-facing router management deserves a fresh review after recent RouterOS warnings. This brief brings together the vendor's update guidance and national incident-response reporting, then explains how defenders can separate remediation from investigation.

This is a late edition covering disclosures from September 3-10, not a claim of a new breach today.

What is confirmed

CERT Polska reported on September 5 that attackers were exploiting a combination of RouterOS vulnerabilities against devices with SSH reachable from public networks. The team says the released fixes prevent the attacks it observed. That establishes exploitation in the reported cases; it does not establish that every exposed router was compromised. CERT Polska's incident warning.

MikroTik's September 3 bulletin lists fixes in 6.49.21, 7.23.4, 7.24.2 and 7.25 beta 3. Administrators should follow the supported release channel appropriate to their deployment, rather than treating a beta as the default production choice. The vendor advises restricting management access and reviewing unfamiliar configuration even without a warning marker. MikroTik security bulletin.

The Canadian Cyber Centre's September 10 alert reinforces the need to identify installed versions, prioritize internet-exposed SSH, apply updates and examine logs. Its version table distinguishes the RouterOS 6.x, long-term, stable and development branches. Canadian Cyber Centre alert AL26-020.

Original conceptual poster: patch status and compromise status answer different questions. Select the image to enlarge.

Explore the diagram

Start with the actual inventory and management path. Coordinate the update with the service owner. Independently review accounts, scheduled tasks and configuration changes; a successful update does not explain earlier activity.

What a warning can and cannot tell you

CERT Polska explains that the Flagged mechanism recognizes selected traces of unauthorized changes. An absent flag is not proof that the device is clean, and a flag alone does not identify which vulnerability was used. Preserve the original evidence and use the vendor's linked recovery instructions when investigating a flagged device. Read the mechanism's limits and response guidance.

A practical review for network and SOC teams

1. Create a scoped device list. Record device owner, software branch, installed version, collection time and approved management route. Resolve missing inventory before marking the fleet complete.
2. Separate exposure from exploitation. An exposed service is a risk condition. An unexplained account or configuration change is an investigative lead. Neither should be replaced with a blanket assumption about the whole fleet.
3. Assign two owners or two work items. Track the update and the evidence review separately. Record the deployed version after the maintenance window and keep investigation questions open until supported by evidence.
4. Validate legitimate changes. Compare unfamiliar accounts, scheduled jobs and tunnels with approved deployment records and trusted administrator confirmation. Preserve the before-and-after configuration and log timestamps under your evidence-handling procedure.
5. Escalate unresolved activity. Involve the network service owner and incident-response team. Isolation or recovery may interrupt connectivity; use the authorized response process and protect evidence before disruptive changes.

These operational steps are Hack Invasion's general defensive analysis, not findings about your devices. Use only authorized administrative access; no exploitation is needed to validate installed versions or review retained records.

Key takeaways

• Use current vendor guidance for the correct software branch.
• Keep patch verification and compromise investigation as separate closure criteria.
• Document uncertainty when logs or configuration history are incomplete.

Related reading

• Prioritizing vulnerabilities with exposure and business impact
• Distinguishing deployment from abuse
• Cyber News archive

Sources reviewed September 14, 2026: MikroTik (September 3), CERT Polska (September 5), Canadian Cyber Centre (September 10). No actor attribution, victim count or new September 14 incident is asserted. Material corrections will be dated.

WPA2 handshake attacks explained — how to keep your wireless network safe

Originally published in 2016 when this blog covered offensive tutorials; rewritten in 2026 with a defensive focus.

How the WPA2 handshake works (and why attackers target it)

When a device joins a WPA2 network, it performs a four-way handshake with the access point to derive session encryption keys from the shared passphrase. In WPA2-Personal, that passphrase is the only secret protecting the network — so the handshake is the attacker's prime target. Conceptually, the attack works like this: the attacker passively captures the handshake, then takes it offline and guesses passphrases against it at high speed. Because the guessing happens offline, the router can't slow the attacker down with rate limiting. If the passphrase is short, common, or predictable, it will fall.

Why deauthentication often accompanies handshake attacks

An attacker who wants a fresh handshake may forge deauthentication frames to force a connected client to rejoin the network, generating new handshake traffic to capture. So a handshake attack frequently starts with the disruption pattern described in our deauthentication article — client drops and reconnects clustered in time.

Signs of a handshake-capture attack in your logs

• A deauthentication flood immediately followed by client reconnects — the classic capture pattern.
• An unfamiliar client device that stays associated without normal traffic (a passive sniffer lingering nearby).
• Repeated reconnection cycles affecting a single client while others remain stable.
• WIDS alerts for deauth floods or unknown stations probing your AP.

How to defend your network

• Move to WPA3 if your hardware supports it. WPA3's SAE handshake resists offline dictionary attacks — captured handshake data is useless for guessing.
• Use a long, random, unique passphrase (20+ characters, generated not memorized) on WPA2-Personal networks. This is the single highest-impact defense on older hardware.
• Enable protected management frames (802.11w) to make the deauth-forced-reconnect trick far harder.
• Disable WPS PIN mode, which offers an independent brute-force path that bypasses passphrase strength.
• Monitor your airspace for deauth floods and rogue stations; treat repeated unexplained client drops as suspicious.
• For businesses: use WPA2/WPA3-Enterprise with 802.1X and per-user credentials, which eliminates the shared-passphrase attack surface entirely.

Authorization disclaimer

All security testing must only be performed on networks and devices you own or are explicitly authorized to assess. Capturing handshakes or attempting to recover passwords for networks you don't own is illegal in most jurisdictions.

Wi-Fi deauthentication attacks: what they are and how to protect your network

Originally published in 2016 when this blog covered offensive tutorials; rewritten in 2026 with a defensive focus.

What is a deauthentication attack?

Wi-Fi networks use management frames — small control messages like "deauthenticate" and "disassociate" — to manage connections between clients and access points. In older protocol versions these frames are neither authenticated nor encrypted, so an attacker within radio range can forge them. By sending spoofed deauthentication frames that appear to come from the access point (or from a client), the attacker forces devices to drop their connection, causing denial of service or repeated reconnections.

Why attackers use them

Deauthentication is rarely the end goal. Conceptually, attackers use it for two things: disruption (knocking users off a network, sometimes repeatedly, as harassment or sabotage) and facilitation — forcing clients to reconnect so the attacker can capture fresh handshake traffic or nudge users toward a rogue access point. What may look like "just kicking someone off Wi-Fi" is the same mechanism used in credential-theft attacks.

What deauth attacks look like in your logs

• A flood of deauth/disassoc frames in access point logs — far more than normal roaming would generate.
• Repeated client drops and reconnects clustered in time, especially affecting many devices at once.
• Source MACs that don't match any associated device, or frames attributed to the AP that arrive at abnormal rates.
• Wireless IDS alerts for "spoofed management frames" or deauthentication floods, if a WIDS is deployed.

How to protect your network

• Enable Protected Management Frames (802.11w) on your access points and clients — this cryptographically protects deauth and disassoc frames so forged ones are ignored. WPA3 mandates it; many WPA2 devices support it as an option.
• Deploy wireless intrusion detection (or at least monitor AP logs) so deauth floods trigger alerts instead of going unnoticed.
• Keep firmware current on routers and access points to ensure management-frame protections are actually available and patched.
• Use strong authentication (WPA3, or WPA2 with a long unique passphrase) so that even forced reconnections don't expose you to handshake-guessing attacks.
• For organizations: consider wireless IPS with automatic containment of rogue APs and RF containment policies for repeated deauth sources.

Authorization disclaimer

All security testing must only be performed on networks and devices you own or are explicitly authorized to assess. Transmitting deauthentication frames against networks you don't own disrupts other people's connectivity and is illegal in most jurisdictions.

Wi-Fi attacks explained (WEP/WPA/WPA2): how to secure your wireless network

Originally published in 2016 when this blog covered offensive tutorials; rewritten in 2026 with a defensive focus.

Why Wi-Fi security matters

Wireless networks broadcast your data through the air. Without proper protection, anyone nearby with an antenna can listen in or attempt to join your network. The encryption protocol your router uses — WEP, WPA, WPA2, or WPA3 — determines how hard that is. Understanding each generation helps you make sure your network is on the right one.

The Wi-Fi encryption generations

WEP — broken and abandoned

Wired Equivalent Privacy (WEP) was the first Wi-Fi security protocol, specified in the 802.11b standard. It uses static encryption keys that never change, and cryptanalytic flaws in the protocol let an attacker recover the key simply by observing enough network traffic. WEP should never be used for anything — treat any device still using it as compromised.

WPA — an interim fix

WPA was introduced as a stopgap while the full 802.11i standard was finalized. It added per-packet keys via TKIP, a major improvement over WEP, but it too has known weaknesses. WPA/TKIP is obsolete and should be disabled.

WPA2 — the long-standing baseline

WPA2 implements the full IEEE 802.11i standard using AES-based CCMP encryption. It has been mandatory on new certified devices since 2006 and remains widely deployed. WPA2 with a strong passphrase is still reasonable, but weak pre-shared keys are vulnerable to offline dictionary attacks, and WPA2 alone does not protect management frames from disruption attacks (see below).

WPA3 — the current best practice

WPA3 replaces the pre-shared key handshake with SAE (Simultaneous Authentication of Equals), which resists offline dictionary attacks, and it mandates protected management frames. If your hardware supports it, WPA3 (or WPA3 transition mode) is what you should be using.

How attackers approach wireless networks, conceptually

Attackers passively capture wireless traffic and look for weak protocols (WEP, WPA/TKIP), weak passphrases susceptible to offline guessing, or client devices willing to connect to a lookalike "evil twin" access point. They may also inject management frames — such as deauthentication packets — to disrupt legitimate connections, which can cause denial of service or pressure clients to reconnect to an attacker's access point.

Signs of wireless attacks in your logs

• A surge of deauthentication or disassociation frames in access point logs or a wireless IDS (WIDS).
• An access point advertising your SSID that isn't yours (rogue or evil-twin AP).
• Clients repeatedly dropping and reconnecting, especially clustered in time.
• Unrecognized MAC addresses appearing in association logs.

How to secure your wireless network

• Use WPA3 where possible, otherwise WPA2 with AES (never WEP or WPA/TKIP).
• Use a long, unique passphrase (20+ characters) that can't be guessed; never reuse the ISP-default key.
• Disable WPS on the router — PIN-based WPS has long-standing brute-force weaknesses.
• Enable protected management frames (802.11w) if your equipment supports it, to resist deauthentication-based disruption.
• Segment your network: use a separate guest SSID with client isolation for visitors and IoT devices.
• Keep firmware updated on routers and access points to patch known protocol flaws.
• Monitor your airspace with wireless intrusion detection or at least periodic scans for rogue access points using your SSID.

Authorization disclaimer

All security testing must only be performed on networks and devices you own or are explicitly authorized to assess. Attempting to intercept or access someone else's Wi-Fi traffic without permission is illegal in most jurisdictions.