View Ridge Security
Back to Cyber Hose

Attackers Hijack MikroTik Routers via Exposed SSH

MikroTik routers are being hijacked through internet-exposed SSH, plus a JetFormBuilder email header injection flaw and REVSTEALER crypto-mining modules.

🕵️ RESEARCH & DEEP DIVES

  • JetFormBuilder before 3.6.5.2 fixes unauthenticated email header injection via Send Email action (CVE-2026-19862)
    The JetFormBuilder WordPress plugin before 3.6.5.2 allows unauthenticated attackers to inject arbitrary email headers via the Send Email action.

    • Affects WordPress sites running the JetFormBuilder — Dynamic Blocks Form Builder plugin in any version before 3.6.5.2, where the Send Email action takes an address from a submitted form field.
    • CVE-2026-19862 (CWE-93, CVSS 4.8): line breaks in form-field address values are not stripped, letting unauthenticated users inject email headers, add hidden recipients, and spoof the sender.
    • The plugin also fixed related unauthenticated flaws in 3.6.5.2: HTML injection into notification emails (CVE-2026-19861) and shortcode injection via form status messages (CVE-2026-19859).
    • Attacks are submitted through normal form posts; exploitation requires no privileges or user interaction.
    • The bug was found by Emirhan Kurt and disclosed via WPScan; the plugin changelog confirms the Send Email header injection fix in 3.6.5.2.
    Sources 📄 Source: wpscan.com · 📎 Coverage: radar.offseq.com · 👁 via CVE ThreatInt

  • Redditor seeks 2–3 cybersecurity teammates for CTFs, hackathons, and security projects
    A Reddit user is seeking 2–3 cybersecurity teammates for CTFs, competitions, and hackathons.

    • The post is open to all skill levels — the poster wants people who show up, learn, and contribute rather than experts
    • Skills and interests sought span web, pentesting, Linux, OSINT, forensics, cloud, crypto, and offensive/defensive security
    • The team is aimed at CTFs, cyber competitions, hackathons, and security projects
    • Interested participants are asked to DM the poster their skills and CTF/project experience
    Sources 📎 Coverage: reddit.com · 👁 via r/cybersecurity

  • Attackers Hijack MikroTik Routers Through Internet-Exposed SSH Without Authentication (5) — <https://thehackernews.com/2026/09/attackers-hijack-mikrotik-routers.html|The Hacker News>

  • Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner (5) — <https://thehackernews.com/2026/09/four-revstealer-linked-modules-disable.html|The Hacker News>

  • rabindralamsal inventory-management-system Login index.php sql injectionA fla... (5) — <https://cve.threatint.com/CVE/CVE-2026-86211?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • SourceCodester Class and Exam Timetabling System delete_user_account.php sql ... (5) — <https://cve.threatint.com/CVE/CVE-2026-86210?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Ninja Forms 3.14.10 - 3.15.1 - Unauthenticated Arbitrary Shortcode Execution ... (5) — <https://cve.threatint.com/CVE/CVE-2026-80437?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Redirection for Contact Form 7 2.2.7 - 3.2.10 - Unauthenticated Arbitrary Sho... (5) — <https://cve.threatint.com/CVE/CVE-2026-80439?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • SourceCodester Class and Exam Timetabling System delete_user.php sql injectio... (5) — <https://cve.threatint.com/CVE/CVE-2026-86209?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • SourceCodester Class and Exam Timetabling System delete_teacher.php sql injec... (5) — <https://cve.threatint.com/CVE/CVE-2026-86208?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • diem-project diem dmWidget BasedmWidgetActions.class.php authorizationA vulne... (5) — <https://cve.threatint.com/CVE/CVE-2026-86183?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • diem-project diem dmConsole actions.class.php executeCommand cross-site reque... (5) — <https://cve.threatint.com/CVE/CVE-2026-86182?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • code-projects Task Management System User Profile Update UpdateUserProfile.ph... (5) — <https://cve.threatint.com/CVE/CVE-2026-86181?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • code-projects Task Management System In PHP Login index.php sql injectionA vu... (5) — <https://cve.threatint.com/CVE/CVE-2026-86180?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • code-projects Daily Expense Manager Database Backup exp_ak.sql information di... (5) — <https://cve.threatint.com/CVE/CVE-2026-86179?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • DefaultFuction CRM delete.php sql injectionA vulnerability was detected in De... (5) — <https://cve.threatint.com/CVE/CVE-2026-86172?utm_campaign=info&utm_medium=rss&utm_source=website|CVE ThreatInt>

  • Hackers Exploiting MikroTik RouterOS Vulnerability in the Wild to Gain Complete Network Access (5) — <https://cybersecuritynews.com/mikrotik-routeros-vulnerability/|Cyber Security News>

  • CrowdStrike Launches Frontier Models for Cybersecurity, Created with NVIDIA (5) — <https://www.reddit.com/r/cybersecurity/comments/1w8pxuo/crowdstrike_launches_frontier_models_for/|r/cybersecurity>

  • Cisco searched for IOS XR bugs and found so many it rolled them into an update release (5) — <https://www.reddit.com/r/cybersecurity/comments/1w8oe8z/cisco_searched_for_ios_xr_bugs_and_found_so_many/|r/cybersecurity>

  • [ Removed by Reddit ] (5) — <https://www.reddit.com/r/cybersecurity/comments/1w8rsq8/removed_by_reddit/|r/cybersecurity>

  • How is DUCAT for a Cybersecurity course? (5) — <https://www.reddit.com/r/cybersecurity/comments/1w8rhza/how_is_ducat_for_a_cybersecurity_course/|r/cybersecurity>

  • CTO at NCSC Summary: week ending September 6th (5) — <https://www.reddit.com/r/cybersecurity/comments/1w8q6xi/cto_at_ncsc_summary_week_ending_september_6th/|r/cybersecurity>

  • How is CRAW Security for a Cybersecurity course? (5) — <https://www.reddit.com/r/cybersecurity/comments/1w8o27q/how_is_craw_security_for_a_cybersecurity_course/|r/cybersecurity>

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check