On September 10, 2026, CISA added two MikroTik RouterOS flaws — a missing authentication check and a command injection — to its KEV catalog after active exploitation. The chain yields remote code execution with no credentials, and the federal remediation deadline lands on September 13.
Between June 17 and July 22, 2026, a single operator compromised more than 14,530 Dahua cameras by chaining brute force, a 2021 flaw and the vendor’s P2P relay — 89% of them with no authentication at all. Hunt.io’s investigation reveals a hard truth: connected video surveillance is an open door by design.
On August 26, 2026, the U.S. Department of Justice and the FBI seized the domains of QScan and QTRouter, two platforms run by a Chinese group that concealed the origin of intrusions against U.S. critical infrastructure. The lesson outlives the news cycle: network obfuscation is now an industrialized service, and it breaks where the attacker has the least redundancy.
An infection chain targeting Android car head units delivers the JarService malware through DoFun’s own TWCore update app. Kaspersky attributes the operation to the MoYu group behind the BadBox botnet — the first documented malware chain built specifically for this class of device.
The Mirai-derived modular botnet Evooo1Bot has been recruiting internet-exposed gateways — Alcatel, NETGEAR, Tenda, D-Link — into resellable SOCKS5 relay nodes since July. Fortinet documents a full arsenal whose economic novelty, the residential relay, should push every operator to inventory their internet-facing routers.
