Over 31M MikroTik Devices Indexed Online Amid Active RouterOS Exploit Chain

·1 views

CERT Polska disclosed a two-CVE exploit chain called MikroTrick on September 5, 2026, targeting MikroTik RouterOS devices with SSH management ports exposed to the internet. The chain combines a missing authentication flaw in SSH public-key verification with an argument injection vulnerability, requiring no password or private key to gain administrator access. ZoomEye data collected on September 19, 2026 shows over 31 million MikroTik-fingerprinted records indexed, though these figures reflect scan observations and do not confirm vulnerable or compromised devices. Public reporting cites more than 122,000 potentially exposed instances, a figure distinct from confirmed intrusions. MikroTik has released patched versions including 6.49.21, 7.23.4, 7.24.2, and 7.25beta3, and administrators are urged to audit SSH reachability across their networks and update immediately.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

ZoomEye Data Shows Scale of Internet-Exposed SonicWall SMA Devices After Zero-Day

Following a SonicWall SMA1000 zero-day vulnerability chain disclosed in September 2026, researchers used the ZoomEye internet intelligence platform to assess how many such devices are publicly reachable online. A product fingerprint query returned just 7 matching records, while a broader free-text search found 416 records across ZoomEye's combined dataset as of September 20, 2026. The low count does not indicate safety, as even a small number of exposed edge appliances represents real, non-hypothetical risk to organizations. ZoomEye's value lies in answering whether a product class is exposed, where that exposure is concentrated geographically, and whether device counts change after a public disclosure. Analysts note that meaningful use of such data requires recording the exact query, dataset type, collection time, and unit of measurement to ensure reproducibility.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four reasons your order system and payment provider totals never match

Businesses across industries routinely face reconciliation disputes where order systems and payment providers report different totals, yet most teams spend days arguing over spreadsheets without resolving the root cause. According to a software analysis, there are four distinct patterns behind these mismatches: amended baskets with shared order IDs, split or partial captures that confuse total-based comparisons, duplicate records from multiple data sources inflating figures, and genuinely missing records caused by failed webhooks or out-of-sync exports. Three of the four patterns involve no actual financial error — the data is simply incomplete, duplicated, or capturing different moments in a transaction's lifecycle. Only missing records represent a true system communication failure requiring investigation. The piece argues that most reconciliation problems persist because teams apply the same fix to all four patterns, when each requires a different and specific response.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

CSS box-sizing Explained: Why Elements Exceed Their Declared Width

A common source of layout bugs in CSS is the default box-sizing behavior, where padding and borders are added outside an element's declared width, making it larger than expected. For example, a 300px element with 20px padding and a 2px border actually renders at 344px under the default content-box model. Switching to border-box tells the browser to include padding and borders within the declared width, keeping the element at exactly 300px. Developers can apply this globally using a universal selector on all elements and pseudo-elements to ensure consistent, predictable sizing across a project. This approach simplifies the layout of common UI components like forms, cards, and buttons without requiring per-element overrides.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Architect builds open-source AI agent that draws in CAD apps and exports IFC models

An architect frustrated with repetitive drafting work built Axio Coder, an open-source AI agent designed to operate CAD and design software from within a user's project environment. Unlike typical coding agents that only read and write files, Axio Coder interacts with programs that have no API — such as CAD windows — by reading the operating system's UI Automation tree rather than guessing pixel coordinates from screenshots. The agent can visually inspect its own output, comparing generated geometry against a reference image or drawing, then iterating corrections before exporting files in industry-standard formats including IFC, DXF, and STEP. It retains memory across sessions, logs every edit as a before-and-after diff, and includes a self-correction mechanism to break out of repetitive loops. Currently a single-user desktop app built on Electron and Python, the tool aims to automate the repetitive 80% of architectural modelling so designers can focus on work requiring human judgement.

0 comments Read more at DEV Community