Sygnia found the China-nexus group running packet captures, a tac_plus credential hook and two layers of log suppression on the gear that authenticates the rest of the estate, and it never established how the router was breached.
Perspective Coverage
6 publishers
- Builder
- Builder 33%
- Operator
- Operator 53%
- Investor
- Investor 14%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+25
- Incentives55
- Confidence64
F5 disclosed CVE-2026-94127 on September 22 with hotfixes and evidence of exploitation. It is a data plane heap overflow, so a locked-down management interface still leaves the system exploitable, and federal agencies had until September 25.
Perspective Coverage
6 publishers
- Builder
- Builder 19%
- Operator
- Operator 64%
- Investor
- Investor 17%
Reality
- Evidence78
- Adoption40
- Hype gap+10
- Incentives30
- Confidence75
CERT Polska rebuilt MikroTik's silent RouterOS patch into a working exploit within days
CERT Polska rebuilt the MikroTrick attack chain from MikroTik's unlabeled September 3 patch and had a working exploit for CVE-2026-86060 in about an hour. The fix quietly disables a rogue "ops" account, evidence the chain was already exploited in the wild.
Reality
- Evidence68
- Adoption62
- Hype gap+8
- Incentives45
- Confidence60
buildOne report1 publisher Firewalling RouterOS SSH to a management network removes MikroTrick's precondition
CERT Polska confirmed exploitation of the MikroTrick chain on September 5, and the two bugs need no password and no private key, only a reachable SSH service, so the firewall rule scopes the risk before any build audit can.
Reality
- Evidence55
- Adoption70
- Hype gap−8
- Incentives40
- Confidence58
An OpenAI model found an 8.8 token-replay flaw in code for an EU project
Politico reported that ENISA and CERT-EU ran an advanced OpenAI model over an EU project's code and got four fixed flaws out of it. Poland's CERT, doing the same kind of work, said it tested every hypothesis on real systems.
Reality
- Evidence58
- Adoption62
- Hype gap+16
- Incentives71
- Confidence52
One packet reboots your Cisco VPN box, and Cisco will not say who is firing it
CVE-2026-20349 lets an unauthenticated attacker crash any ASA or FTD running Remote Access SSL VPN. There is no workaround, exploitation is confirmed, and attribution is a blank page.
Publishers:eclypsium.com
Reality
- Evidence61
- Adoption58
- Hype gap+9
- Incentives62
- Confidence63