Two Critical RouterOS Flaws Allow Unauthenticated Admin Access to Edge Devices

·4 views

MikroTik RouterOS was found to contain two serious vulnerabilities, CVE-2026-67279 and CVE-2026-86060, patched on 3 September 2026, that together allow attackers to gain full administrative control without a password or key. The first flaw mishandles SSH rekeying during authentication, while the second misinterprets a hyphen-prefixed username as a command option, bypassing login checks entirely. Because RouterOS devices typically sit at the network boundary, exploitation can enable traffic interception, firewall modification, VPN key theft, and persistent account creation. Observed attack activity included creation of a privileged SSH account and exfiltration of device diagnostic files to an external address. Fixes are available in RouterOS versions 7.25beta3, 7.24.2, 7.23.4, and 6.49.21, and administrators are urged to patch promptly, audit accounts, rotate credentials, and restrict public management access.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

containerd 2.2 mount manager slower and buggier than manual disk setup

A developer benchmarked containerd 2.2's new mount manager against a manual four-command sequence for formatting and attaching a 200MiB ext4 image as a loopback device. The mount manager's Activate call took between 29.6ms and 47.2ms per run, while the manual approach consistently finished in 23.5 to 25.9ms. Beyond being slower, the manager also panicked once, leaked a raw BoltDB error, and left an orphaned loop device that could not be recovered. The overhead stems from BoltDB writes, symlink creation, and bookkeeping rather than any difference in the underlying formatting tools, since the manager shells out to the same mkfs.ext4 binary as the manual path. The mount manager is designed for composability within snapshotters and runtime shims, not for raw performance, and the developer tested against containerd v2.2.2 bundled with Docker Engine 29.3.1.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS Lambda Durable Functions Harbor a Silent Replay Bug in AI Approval Workflows

A developer building a human-in-the-loop AI agent workflow using AWS Lambda durable functions—released in late 2025—discovered that the system executed a different action than the one a human had explicitly approved. The root cause was the replay mechanism central to how durable functions work: when a paused workflow resumes, Lambda reruns the handler from the top and reinjects checkpointed results, which can silently mismatch with runtime state if code is not structured carefully. The workflow was designed to let an AI agent propose an action, pause for human approval, then execute only the approved action—but the replay behavior caused it to execute the wrong one. The bug was not in business logic or a race condition, but in a misunderstood framework feature that can affect any multi-step workflow with external callbacks. A single structural code fix was found to reliably prevent the issue, and the author validated the solution both locally and on a live Lambda deployment.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Student Builds Trade Analytics Boilerplate Using Streamlit and Plotly

An AI/ML student and freelance developer created LandedIQ, a trade analytics dashboard that calculates landed costs by combining base price, import duty, freight, and insurance. Built with Streamlit and Plotly, the project was born after the developer repeatedly rewrote the same currency conversion and charting logic across multiple client projects. Key technical decisions included using Plotly over streamlit-echarts due to Python 3.13 compatibility issues, and caching exchange rate API calls hourly to prevent redundant requests. The app is deployed on Railway, requiring a manual start command to bind to all network interfaces rather than just localhost. The developer has since packaged the project as a purchasable boilerplate, complete with documentation and a PDF setup guide, listed on Gumroad and Contra.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Paper Cuts Quantum Attack Resource Estimates, Raising Blockchain Security Urgency

A March 2026 Google Quantum AI paper, co-authored with researchers from the Ethereum Foundation and Stanford, found that Shor's algorithm could break 256-bit elliptic curve cryptography — the basis of Bitcoin and Ethereum wallet security — using roughly 10 times fewer computational resources than previously estimated. The authors used a zero-knowledge proof to validate their findings without publicly releasing the attack circuits, making the results verifiable but not independently reproducible. Experts highlight two distinct threats: a future 'Q-day' when quantum hardware becomes capable enough to break live keys, and the already-active 'harvest-now-decrypt-later' risk, where adversaries collect signed transactions today to decrypt them once hardware matures. Unlike ephemeral web traffic, blockchain transaction data is permanently public, meaning exposed public keys remain vulnerable indefinitely. Wallet infrastructure builders are urged to begin post-quantum migration planning now, regardless of uncertainty around the exact timeline for cryptographically relevant quantum computers.

0 comments Read more at DEV Community