Third issue of our weekly review. Every Friday, the events of the last seven days, read through the eyes of a risk owner rather than an analyst. For each one, what it changes for a Canadian organization, and the question to ask on Monday morning.
Two weeks ago the thread was operations grinding to a halt. Last week, the AI toolchain. This week it fits in one sentence: the patch now arrives after the attacker. Routers exploited the day before the update, an e-commerce platform exploited four days before the hotfix, a firewall console whose vendor promises the hardened release next week, and 966 Microsoft fixes to triage in a single Tuesday. Then three stories that needed no vulnerability at all: a ransomware claim in Quebec, an API key forgotten in a website's code for four years, and one AI gateway in ten still accepting the password from the documentation.
Part 1: the race is lost before it starts if the patch is the only control
Cisco, Citrix, Fortinet, MikroTik: four edge vendors exploited, twelve flaws added to KEV in one week
From 4 to 10 September, CISA added twelve vulnerabilities to the KEV catalogue on evidence of active exploitation. Five of them target edge equipment, and that is the pattern of the week.
Cisco Secure Firewall Management Center (CVE-2026-20079, CVSS 10.0) is the console that administers an organization's Cisco firewalls. An authentication bypass yields root code execution with no credentials. On 9 September, Cisco Talos documented three distinct groups exploiting it, including Qilin ransomware affiliates and a state actor whose tooling overlaps with Sandworm, which deploys the Cyclops Blink implant and harvests the configurations of managed devices. A hotfix exists; the full hardened release is announced for the week of 14 September. US federal deadline: 12 September, three days after the listing.
The same day, CISA listed Citrix NetScaler (CVE-2026-19490, CVSS 9.3), an authentication bypass on gateways configured for SSL VPN or ICA proxy, with 56 attempts observed against honeypots since 3 September, 36 of them on 8 September alone, and Fortinet (CVE-2025-25249, CVSS 7.3), a 2025 flaw now weaponized to deliver the PivotC2 command-and-control tool: more than 3,000 addresses targeted, 178 devices infected.
MikroTik RouterOS closes the week. Two chained flaws (CVE-2026-67277 and CVE-2026-86060), dubbed MikroTrick, give full administrative control of any router whose SSH is reachable from the internet. Exploitation has been observed since 2 September; the patch shipped on 3 September. Attackers create an account named "ops" and rewrite firewall and proxy rules. The Belgian and Polish CERTs are explicit: a router showing those traces gets a factory reset, the patch alone is not enough.
What it changes: this is the fourth consecutive week where edge equipment is the way in, after NetScaler, Gunra and SonicWall. What is new is the calendar: exploitation precedes or follows the patch by a few days, and the vendor itself warns that the clean release comes next week. A plan that says "we apply critical patches within 30 days" no longer describes a control, it describes an exposure window. For every edge device on your external attack surface, the question becomes: how many days do we set the window at, who decides on presumed compromise, and how long can remote access stay down during a rebuild?
Magento: a zero-day exploited four days before the hotfix, one server compromised in 50 minutes
Sansec discovered StyleSmuggler (CVE-2026-75650, CVSS 10.0), unauthenticated code execution on Magento Open Source and Adobe Commerce, every version from 2.4.4 to 2.4.9. Attacks started on 4 September. Adobe published the emergency hotfix on 7 September. In between, attackers planted a Rust-based Linux backdoor and PHP web shells on online storefronts; one server was compromised 50 minutes after the attack began. Remediation requires the hotfix and rotation of the encryption keys, because a key stolen during the window stays valid after the patch. CISA listed the flaw on 8 September, with an 11 September deadline.
In the same 8 September alert, CISA listed N-able N-central (CVE-2026-86218), pre-authentication code execution on a remote management platform widely used by managed service providers. It is N-central's fourth emergency hotfix in five weeks. N-able wrote to its customers that the flaw was being exploited, while the release notes describe a responsible disclosure with no confirmed exploitation. Both statements come from the same vendor, one day apart.
What it changes: an online store processes payments, and a remote management tool holds the keys to every one of its clients' endpoints. In both cases, a patch applied the day it ships arrives after the attacker. The control that matters is therefore elsewhere: the ability to detect a shell dropped on 5 September, and the procedure that triggers a forensic review as soon as a component was exposed during a known exploitation window. For a managed service provider, the question for your third-party register is direct: which remote administration tool do they run on our systems, and when do they tell us about an emergency hotfix?
966 Microsoft fixes in one Tuesday, a record, and two exploited zero-days
On 8 September, Microsoft fixed 966 vulnerabilities, the largest Patch Tuesday in its history, 105 of them rated critical. The 570-flaw record we commented on a few months ago is gone. Two flaws were already exploited: CVE-2026-81963 in the Windows Update stack and CVE-2026-85880 in the ALPC mechanism, both local privilege escalations that hand SYSTEM level to an attacker already on the machine. CISA added them to KEV the same day, deadline 22 September.
The record is not an accident, it is a cadence. Microsoft issued 1,928 security fixes over the last three months, nearly matching the 2,137 released across all of 2024 and 2025. Since January, the count exceeds 2,600, more than twice the record year of 2020 and its 1,245 flaws. Software vendors are correcting flaws faster, partly because AI is speeding up vulnerability discovery. Satnam Narang of Tenable adds a caveat: AI-assisted discovery "is creating larger haystacks, but it isn't finding more needles". In other words, the volume rises, and the share that is actually exploited does not follow in the same proportion.
What it changes: at 966, nobody reads the list, and at this pace, the list will stay that size. Vulnerability governance becomes a triage rule written in advance: what is on KEV, what is exposed, what sits on an edge device, in that order, and a deadline per category. The rest is deferred, and the deferral is signed. If your team applies "everything, as soon as possible", it is actually applying "whatever it had time for", without anyone having decided the order.
Part 2: three stories that needed no vulnerability at all
CCQ: Qilin claims the data of 350,000 people
On 4 September, the Russian-speaking Qilin group claimed the attack that has paralysed the Commission de la construction du Québec since 24 August. According to La Presse, the personal information of 350,000 people was stolen, the administrative and medical records of the industry's workers, including dates of birth and social insurance numbers. The group threatens to publish everything if no negotiation opens. The same day, the CCQ confirmed in its official update that "certain" client and employee information was stolen, without specifying its nature or the number of people, and is offering those affected Equifax credit monitoring. Online and telephone services resumed on Tuesday 8 September, fifteen days after the intrusion.
It is not the only Canadian name of the week. On 7 September, the Metaencryptor group listed EllisDon, one of the country's largest builders, on its leak site; the company has not confirmed and the claim remains, at this stage, an allegation. In total, nine Canadian organizations were claimed between 4 and 10 September according to ransomware.live, including three manufacturers listed on the same day by the Storm group.
What it changes: two construction players, Quebec's joint industry body and a major Ontario contractor, in the same week. If you are in that sector, your subcontractors, your suppliers and the body that manages your workers' competency cards are all on the same list. And for the CCQ, the most expensive part is not the leak, it is the downtime: fifteen days without online or telephone services for an entire industry, which is what our continuity plan that survives an attack addresses. The governance fact is that Qilin is also one of the three groups Talos saw exploiting the Cisco console this week: the same actor, two ways in.
Manchester Airports: 8.8 million travellers, one API key in the website code for four years
Manchester Airports Group, which operates Manchester, London Stansted and East Midlands airports, had announced on 27 August a breach "in a third-party database". On 2 September, the extortion group FulcrumSec published roughly 550 GB of data after the ransom was refused: 8,672,291 customer profiles with email, phone, postcode and IP address, 108,077 vehicle registration plates, 461,433 booking SMS messages and 190,849 future bookings with travel times. Payment card data was not in the set. On 9 September, researcher Scott Helme verified the access method described by the attackers: the admin keys for the Iterable marketing platform were written in plain text in the public JavaScript of all three sites, visible to any visitor with a right-click, and unrotated for more than four years.
What it changes: no vulnerability, no exploit, no zero-day. A vendor key left in a public page. The third party is not at fault here; the key belonged to the customer. Two questions for your inventory: which API keys for your SaaS vendors do your own sites and applications embed, and how long since they were last rotated? Law 25 asks you to document where personal information lives; it assumes you also know who holds the key to the door.
One AI gateway in ten still accepts the password from the documentation
On 9 September, Wiz published the follow-up to its work on LiteLLM, the AI gateway we covered last week after its KEV listing. Of 3,074 instances exposed on the internet, 294, or 9.6%, accepted the master key "sk-1234", the example value from the vendor's quick-start guides; 191 of them simply had no key configured at all. With that key, an attacker reads every model-provider API key stored on the gateway, reaches the internal tools connected through MCP and, through a relay feature that does not filter internal addresses, queries the cloud metadata service to obtain temporary IAM credentials.
In the same vein, CISA confirmed this week that the December 2025 WatchGuard Firebox flaw (CVE-2025-14733) is now exploited by ransomware groups. Nearly 9,000 firewalls remain unpatched, nine months after the fix.
What it changes: neither exposure needs a new vulnerability. One is a configuration never changed, the other a patch never applied. Both probably sit in a dashboard somewhere marked "compliant". The question to ask is not "do we have a secrets management policy" but "who verified, on the actual systems, that the default value is gone". That is the difference between a declared control and an observed one, the same gap we measure between a vendor's questionnaire and its actually visible surface.
The week's three questions for an executive committee
- For our edge equipment, firewalls, management consoles, routers, VPN gateways, how many days do we set the patch window at, and who decides on presumed compromise and rebuild?
- Out of 966 fixes, which ones do we apply this week, under which written rule, and who signs off on deferring the rest?
- How many API keys and admin passwords, ours and our vendors', are still at their example value or older than a year, and who verified that on the systems rather than declared it in a questionnaire?
If these three questions have no documented answer, our free cyber risk score places you in ten minutes across the vulnerability, third-party and resilience domains. To track these exposures continuously rather than once a year, that is the job of the attack surface and threat intelligence modules of the FortaRisks platform.
One more thing, and then we will stop talking about ourselves
FortaRisks will be at GoSec on 23 and 24 September in Montreal. Come talk risk, not product: bring the third-party question you cannot answer, or the AI use nobody owns yet, and we will work through it together at the booth. To book a slot, write to us.
Sources: Cisco Talos, Secure FMC exploitation · CISA, 9 September alert · The Hacker News, Cisco, Citrix and Fortinet added to KEV · CISA, 10 September alert, MikroTik · BleepingComputer, MikroTrick · Sansec, StyleSmuggler · CISA, 8 September alert · Help Net Security, N-able N-central · BleepingComputer, September Patch Tuesday · Krebs on Security, nearly 1,000 security holes plugged · La Presse, CCQ cyberattack · CCQ, 4 September update · ransomware.live, Canadian victims · The Register, Manchester Airports Group · Security Affairs, 8.8 million people · Wiz, LiteLLM · BleepingComputer, WatchGuard and ransomware