MikroTik

Mi- Mi- Microtik, yeah.

MikroTik is how I was reading it.

It, it looks like MikroTik, yeah.

Yeah

But it's, it's Microtik.

...

if you're using a Mikrotik router-

Yeah

...

Yeah

... critical pre-auth RCE flaw in their router OS.

Well, a lot of the, a lot of the Mikrotiks can operate in several different modes, depending on sort of which OS you boot it into, whether it's kind of, uh, you know, a border, uh, piece, you know, as a, or a r- or true a router.

Whether it, you know, acts as, uh, you know, like, um, uh, something you can pull IP addresses off of, or whether you're just using it internally.

Maybe they didn't even intend on doing that.

But li- like I told you before, when I was looking at this MicroTik vulnerability trying to see if it actually can be replicated by a threat actor live, um, GLM was thinking of itself as Claude.

So basically GLM thought that it, he, GLM, it, GLM is Claude, which makes me think that it has been trained or post, uh, actually post-trained on, uh, Claude, uh, thinking traces.

And, uh, if it has been trained on that-

Looks like more than two million users have downloaded it so far and are amazingly happy with it based on the four point eight star rating.

Then we got a little bit of weird, interesting story about MikroTik and RouterOS.

CISA published an advisory with a summary of a new vulnerability in RouterOS, CVE-2026-84411.

This vulnerability is distinct from vulnerabilities being associated with the MikroTik vulnerabilities released earlier in September.

Problem is, there is no real advisory like this on the MikroTik website.

Also, CISA states that, um, RouterOS seven point two four is safe, is patched, which was released in August.

So I can only assume that this may be a silently patched vulnerability.

So definitely something that you must have on the radar.

And if you can't, aggressively monitor your WAF logs for anomalous UDP traffic.

And finally, your immediate drop-everything priorities for today are Microsoft SharePoint and MikroTik RouterOS.

Do not let that old spoofing classification lull you into a false sense of security with SharePoint.

It is remote code execution, and it is being exploited right now.

Right.

And for MikroTik, if management interfaces are exposed to the internet, you have to assume attackers are actively using the MikroTrik chain to bypass your passwords.

Patch it or block the access today.

It is a tremendous amount of pressure to place on a security team.

FreeSDN is the closest thing to TrueMix and Match.

Version 2609.0.0, AGPL-licensed, 13 vendor adapters including TP-Link OMADA, Ubiquiti UniFi, Mikrotik, and OpenVert.

Requires 4GB of RAM minimum.

And the architecture is the clever bit.

Can you talk about how you think Unimus or customers are using Unimus as part of their security operations?

Sure, and I think one of the good examples is, and this affected even other infrastructure, and it was even our own workflow, and lots of customers use it too, is there was a security vulnerability, like a 9.2 CVSS vulnerability in MikroTik's router OS.

And I love MikroTik.

It's nothing against

MikroTik.

This happens all the time to Cisco, Juniper, to everyone.

Exactly.

Yeah.