Three things happened in the last seven days that, taken together, say more about where this is heading than any one of them does alone.
Google patched the sixth actively exploited Chrome zero-day of 2026. Six separate flaws turned up in MikroTik routers, two of them already being chained together to plant unauthorised admin accounts on live networks. And OpenAI's newest model, GPT-6 Astra, was assessed as able to find previously unknown vulnerabilities and build working exploits for them without a person doing the hard part.
None of this reached a normal business owner's week. All three should have — at least in the sense that somebody ought to have been watching for them on your behalf.
What Actually Happened
The short version, without the vendor jargon:
| What broke | Why it matters to you | Risk |
|---|---|---|
| Chrome V8 engine CVE-2026-85046 |
A type confusion bug rated 8.8. Loading a booby-trapped web page is enough to run code on the machine — no download, no attachment, nothing that looks obviously wrong. Sixth actively exploited Chrome zero-day this year. | Critical |
| MikroTik RouterOS CVE-2026-67276 + CVE-2026-86060 |
Both rated 9.2. Chained together they let an attacker skip login entirely and take full control of the router — if SSH is reachable from the internet. Being exploited right now. | Critical |
| MikroTik bandwidth test CVE-2026-67277 |
Rated 8.8. Leaks kernel memory from the device. Three further lower-severity flaws affect the SSH client, certificate handling and WebFig. | High |
| Dropbox via Lenovo ID | A weakness in Lenovo's email verification let attackers register a Lenovo ID on someone else's address and walk in through the federated login path. Roughly 5,000 accounts taken over across a 17-day window. | High |
Chrome: the sixth one this year
Google shipped the fix in version 152.0.7977.82 for Windows, macOS and Linux. If your browsers update themselves, you are probably fine. If updates are handled manually, or if there are machines in the office that nobody has restarted in a fortnight, you are not — Chrome downloads the update quietly but only applies it on restart. That is the gap that catches people.
MikroTik: 122,500 routers sitting open
Researchers found six vulnerabilities in RouterOS. Two of them, both rated 9.2, let an unauthenticated attacker bypass login and take the device outright, provided SSH is exposed to the public internet. Attackers have been chaining them in a campaign nicknamed MikroTrick, creating an admin account named ops and taking full control.
A single 24-hour scan on 5 September found roughly 122,500 MikroTik devices with SSH reachable from the internet. Patches exist — RouterOS 6.49.21, 7.23.4 and 7.24.2 — but a patch only helps if somebody applies it, and a router is exactly the kind of device nobody thinks to check.
Worth doing today if you run MikroTik: turn off SSH and admin access on the internet-facing interface unless you genuinely need it, update RouterOS, then look at the device's user list. If there is an account called ops that nobody created, you are already in the middle of this.
An AI that finds zero-days on its own
This is the one worth sitting with. GPT-6 Astra scored 100% on ExploitBench — a benchmark that measures whether a model can turn a known vulnerability into a working exploit — against 78.5% for the model before it. It also produced exploits for two genuinely unknown vulnerabilities discovered between June and August. OpenAI rated it at the Critical cybersecurity threshold under its own Preparedness Framework, the highest band it has.
To be fair about what shipped: the public version is restricted to secure code review and patching, and refuses requests for proof-of-concept exploits. Those safeguards are real and they matter. But the ceiling has moved, and ceilings do not move back down. The task that used to need a skilled human researcher and real time is now a capability that exists — and defenders should plan for the version of it that does not come with guardrails.
The Pattern Underneath All Four
Every one of these has the same shape. A flaw existed. Something automated found it or weaponised it faster than a person would have. And the businesses that got hurt were the ones where nobody was in a position to respond at that speed.
That is the real shift, and it is not a future-tense concern. Attackers already had automation. Now they are getting tools that find novel flaws and write working exploits without a human doing the difficult part. The gap between "a vulnerability exists" and "a vulnerability is being exploited" keeps compressing, month over month.
A business on a manual patch schedule — someone checks for updates monthly, or whenever they remember — was already behind. Against exploitation moving at machine speed, "behind" turns into "exposed" a great deal faster than it used to.
One Correction Worth Making
The Dropbox story got reported in a few places as attackers defeating multi-factor authentication. That is not what happened, and the real version is more useful.
Every single one of the ~5,000 compromised accounts had MFA switched off. Dropbox trusted Lenovo's claim about who owned an email address, so a fraudulent Lenovo ID was enough to get in without the password. Multi-factor authentication would have blocked the attack completely. The lesson is not that MFA is unreliable — it is that federated login is a second front door, and MFA is the lock on it.
If your business signs in to anything through Google, Microsoft, Lenovo or any other identity provider, that provider's verification step is part of your security whether you think about it or not. Enforce MFA on the account itself, not just on the provider.
What To Do If You Don't Have a Security Team
You do not need to solve the AI arms race. You need your own basic automation running at least as fast as the threats are:
-
Force browser updates, don't ask for them
Chrome, Edge and Firefox all support enforced update policies. Across a fleet of machines this should never depend on an employee choosing "update later" — and it should include a nudge to actually restart the browser, because that is when the fix takes effect.
-
Audit what accepts admin access from the internet
Go through your routers, firewalls, NAS boxes and cameras, and switch off remote SSH and admin access wherever it isn't strictly needed. Where it is needed, restrict it to known IP addresses. MikroTik is this week's example, not the only vendor with this exposure.
-
Turn MFA on everywhere, especially where you use single sign-on
Every account that can be reached through a third-party identity provider needs its own multi-factor layer. The Dropbox breach is the cleanest possible demonstration: MFA was the difference between an account being taken and an account being fine.
-
Move from scheduled patching to continuous monitoring
Monthly patch cycles were built for a threat landscape that moved monthly. Knowing an update exists is only half of it — someone has to notice the machines where it silently failed, and notice a device growing an admin account it should not have.
Where Automation Helps You, Not Just the Attackers
The honest version of this story isn't only "attackers have AI now, be afraid." The same automation that speeds up exploitation speeds up defence — but only if it is actually in place. Behaviour monitoring flags an unauthorised account appearing on a router in minutes rather than at the next quarterly review. Automated deployment closes a browser gap the day the update ships, not whenever someone gets to it.
That is a large part of why AI-assisted security has become the fastest-growing slice of managed IT. The work has genuinely outpaced what one person checking dashboards can keep up with. We wrote about that shift in more detail in why AI is no longer optional for MSPs, and about how to tell a real capability from a marketing claim in how to tell if your IT provider actually uses AI.
This is what "managed" is meant to mean in managed IT: not a helpdesk you ring after something breaks, but a system already watching, already patching, and already quicker than what is coming for it.
If you aren't certain whether your routers accept admin access from the internet, whether every machine is genuinely on the current browser build, or what happens at 2am when something starts creating accounts it shouldn't — that is worth settling this week rather than after the next advisory. Talk to TekyTec and we'll tell you plainly where the gaps are.
Sources: Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day — The Hacker News; Hackers exploit RouterOS flaws to hijack MikroTik devices without authentication — Help Net Security; MikroTik September 2026 vulnerability advisory; GPT-6 Astra Scores 100% on ExploitBench as OpenAI Blocks PoC Exploit Requests — The Hacker News; Dropbox Accounts Breached: Lenovo ID Email Flaw Bypassed Passwords for 17 Days — TechTimes.
Frequently Asked Questions
Can AI really write working exploits on its own?
In testing, yes. GPT-6 Astra scored 100% on ExploitBench — a benchmark measuring whether a model can turn a known vulnerability into a working exploit — up from 78.5% for the model before it, and it built exploits for two previously unknown flaws found between June and August 2026. OpenAI classified it at the Critical cybersecurity threshold under its Preparedness Framework and shipped the public version limited to secure code review and patching, refusing proof-of-concept exploit requests. The safeguards are real. The capability ceiling still moved, and it does not move back.
How do I check whether my Chrome browsers are actually up to date?
Open Chrome, go to Settings and then About Chrome. It checks and installs on the spot, but the update only takes effect once the browser restarts — which is why machines left open for weeks stay vulnerable even with auto-update on. For CVE-2026-85046 you want version 152.0.7977.82 or later on Windows, macOS and Linux. Across a fleet, enforce it by policy rather than leaving it to each person.
How do I know if my router is exposed to the MikroTik attacks?
The MikroTrick campaign only works against RouterOS devices with SSH reachable from the public internet — a 24-hour scan on 5 September 2026 found around 122,500 of them. Check whether remote SSH or admin access is enabled on your router's WAN interface and switch it off unless you have a specific reason for it; if you need it, restrict it to known IP addresses. Then update RouterOS to 6.49.21, 7.23.4, 7.24.2 or later, and check the user list for accounts nobody created — this campaign has been adding an admin user named ops.
Does multi-factor authentication still protect me after the Dropbox breach?
It does, and this breach is the clearest argument for it. Around 5,000 Dropbox accounts were taken over through a flaw in Lenovo ID's email verification during a 17-day window in August 2026, and every compromised account had one thing in common: MFA was switched off. It would have stopped the attack outright. The lesson isn't that MFA failed — it's that a federated login path is a second front door, and MFA is what keeps it locked.
How fast does a small business actually need to patch now?
For anything actively exploited, days rather than weeks. Monthly patch cycles were designed for a threat landscape that moved monthly, and that landscape is gone. Browsers and internet-facing network devices should update automatically, with someone watching for the ones that fail. If nobody would notice a router quietly gaining a new admin account overnight, the patch schedule isn't the first thing that needs fixing — the monitoring is.