Overview
- Researchers led by CERT Polska reconstructed the exploit chain and published clear indicators after finding logs that date to at least September 2 showing the attack sequence.
- The chain combines an SSH state‑machine renegotiation bug (CVE-2026-67279) that skips authentication and an argument‑injection flaw (CVE-2026-86060) that lets attackers set a full privilege mask by sending a username like "-2".
- MikroTik released RouterOS fixes in early September that address those two flaws plus a separate btest denial‑of‑service bug, and CISA added the argument‑injection CVE to its Known Exploited Vulnerabilities list on September 10.
- CERT Polska published concrete forensic signs to hunt for, including rejected SSH logins for user "-2", creation of a privileged "ops" account, and attacker IPs, and advised limiting SSH exposure, applying patches, isolating compromised devices, and not restoring infected backups.
- The team used AI‑assisted patch diffing and binary analysis to speed reconstruction, a shift that lets public technical details appear far sooner than many organizations can patch or clean up, increasing urgency for rapid detection and response.