Let me ask you something: when you leave your business for the evening, do you lock the front door?

Of course you do. You may even check the windows, set the alarm, and make sure nobody left a side entrance open.

But what about the overlooked network closet? The router, firewall, Windows computers, and remote-access systems sitting quietly behind your business operations may have their own unlocked windows.

That is the theme running through this week’s biggest security stories. Attackers are not always forcing their way through the front door. Sometimes, they are exploiting an old software flaw, an internet-exposed router, or a management appliance nobody remembered to patch.

Here is what you need to know if your business operates in St. Louis, St. Charles County, Chesterfield, Clayton, O’Fallon, the Metro East, or anywhere across Missouri.

1. Microsoft’s Record Patch Tuesday Includes Two Exploited Zero-Days

Microsoft’s September 2026 security release fixes 974 Microsoft CVEs, making it the largest Patch Tuesday release in the company’s history, according to the Microsoft Security Update Guide.

That number is difficult to picture. Think of it as discovering hundreds of problems with the locks, windows, wiring, and alarms throughout an entire building at the same time.

And here is where it gets serious: two of the vulnerabilities are already being exploited.

The first, CVE-2026-81963, affects the Windows Update Stack. A local, low-privileged attacker can abuse improper link resolution to elevate their access to SYSTEM, Windows’ highest privilege level.

The second, CVE-2026-85880, affects Windows Advanced Local Procedure Call, or ALPC. In plain English, an attacker operating inside a restricted application environment may be able to escape that “sandbox” and gain SYSTEM-level control.

Both vulnerabilities carry a CVSS score of 7.8, and both have been added to CISA’s Known Exploited Vulnerabilities Catalog. Federal agencies were required to remediate them by September 22, 2026.

The deadline matters, but the lesson matters more: patch management is not optional.

Small businesses are often the last organizations to apply updates because there is no dedicated IT team watching every endpoint. Unfortunately, that can also make them the first targets when attackers begin using a known exploit.

What you can do this week

• Confirm that every supported Windows computer has received the September security updates.
• Prioritize computers used by owners, administrators, accounting staff, and remote workers.
• Patch Windows servers and systems that manage updates or user access.
• Review devices that have missed previous updates.
• Document exceptions instead of allowing “temporary” delays to become permanent.
• Verify that updates installed successfully rather than assuming they did.

A monthly update routine is helpful. A monitored, documented patch-management program is much stronger.

That distinction is one reason businesses turn to St. Louis managed IT services instead of waiting for a crisis.

2. “MikroTrick” Gives Attackers Full Control of Exposed MikroTik Routers

Now imagine your office has a locked front door, but someone left the master key hanging outside the building.

That is similar to what attackers can accomplish with MikroTrick, an attack chain targeting MikroTik RouterOS.

The chain combines CVE-2026-67276 and CVE-2026-86060. Together, the flaws can allow an unauthenticated attacker to bypass SSH authentication and gain full administrative control of an internet-exposed MikroTik router.

As of early September, researchers identified approximately 122,500 MikroTik devices with SSH reachable from the internet.

That does not mean every one of those devices was compromised. It does mean a large number of routers were publicly exposed and potentially available for attack.

MikroTik lists fixes in:

• RouterOS 6.49.21
• RouterOS 7.23.4
• RouterOS 7.24.2
• RouterOS 7.25 beta 3

You can review the vendor’s September 2026 RouterOS security notice and CERT Polska’s MikroTik vulnerability advisory.

Why does this matter locally?

Routers and firewalls in St. Louis offices, retail shops, dental practices, warehouses, and medical businesses often sit in overlooked network closets. They may run for years without anyone checking the firmware, reviewing administrative accounts, or asking whether SSH really needs to be exposed.

Warning signs to review

• Login attempts using the username -2.
• An unfamiliar privileged account named ops.
• Unexpected scripts in the RouterOS configuration.
• Firewall rules that nobody on your team remembers creating.
• New SSH access from unusual countries or addresses.
• A MikroTik device reporting a “Flagged” status.
• RouterOS versions older than the fixed releases.

What you can do this week

• Upgrade RouterOS to the appropriate fixed release or newer.
• Disable internet-facing SSH unless it is absolutely necessary.
• Restrict management access to trusted IP addresses or a secure VPN.
• Rotate administrative passwords and SSH keys after patching.
• Review users, scripts, scheduled tasks, and firewall rules.
• Rebuild a device from trusted firmware if you find evidence of compromise.

Here’s the uncomfortable truth: your router is not “just networking equipment.” It is the gatekeeper for your business network.

If an attacker controls it, they may be able to monitor traffic, redirect connections, create access paths, or use it as a launch point for attacks against everything behind it.

3. PoisonedRefresh Shows Why File Scanning Is Not Enough

Here is another shocker: sometimes the malicious code never gets written to disk.

Security researchers have reported PoisonedRefresh, a fileless Linux rootkit targeting F5 BIG-IP Access Policy Manager devices after exploitation of CVE-2025-53521.

F5 describes CVE-2025-53521 as a remote code execution vulnerability affecting BIG-IP APM systems when an APM access policy is configured on a virtual server. The vendor now rates the issue as critical, with a CVSS score of 9.8, and states that the vulnerability has been exploited.

PoisonedRefresh infects the Apache process and injects a web shell into memory-mapped PHP scripts. It can also create a local socket for interactive shell access.

The files on disk may still look clean.

That means standard antivirus and file integrity monitoring may not see what is happening. The malicious behavior exists in memory, inside a running process.

Think about it this way: you can inspect every paper file in an office and find nothing wrong, while someone is still actively using a hidden computer in the conference room.

F5 identifies affected BIG-IP APM branches and fixed versions in its CVE-2025-53521 advisory.

What you can do this week

• Identify whether your business uses BIG-IP APM or a similar remote-access appliance.
• Confirm the device version and whether it falls within an affected range.
• Apply the vendor’s fixed release.
• Review F5’s indicators-of-compromise guidance.
• Monitor unusual Apache, PHP, process, and memory behavior.
• Investigate unexpected local sockets or modified system utilities.
• Rebuild from a known-good source if compromise is suspected.
• Rotate credentials used through the affected remote-access system.

The takeaway is bigger than one F5 product: visibility must include behavior, not only files.

That is an important part of modern cyber security solutions for small business, especially when your business depends on VPNs, cloud applications, remote access, and specialized appliances.

4. Cisco Firewall Management Center Flaws Are Being Used in Live Attacks

Your firewall is supposed to be the security guard at the building entrance.

But what happens if attackers compromise the guard’s control room?

Cisco Talos is tracking active exploitation of two vulnerabilities in Cisco Secure Firewall Management Center, or FMC.

CVE-2026-20079 is a critical authentication bypass vulnerability with a CVSS score of 10.0. An unauthenticated remote attacker can bypass authentication and execute commands as root on affected systems.

CVE-2026-20316 involves static, low-privileged credentials. Its CVSS score is lower at 5.3, but attackers can use it with other vulnerabilities to gain greater access.

Cisco Talos has identified three post-compromise activity clusters. One is associated with Sandworm-linked activity and Cyclops Blink tooling. Another cluster shows behavior consistent with a Qilin ransomware operator, including reconnaissance, credential theft, tunneling, and preparation to encrypt endpoints.

Federal agencies were required to remediate the critical issue by September 12, 2026. For businesses, the deadline is not the important part. The active exploitation is.

Read Cisco Talos’ active exploitation report and Cisco’s CVE-2026-20079 advisory.

What you can do this week

• Determine whether you operate an on-premises Cisco Secure FMC system.
• Apply Cisco’s hotfixes for both CVE-2026-20079 and CVE-2026-20316.
• Review administrator and low-privileged accounts for unexpected activity.
• Inspect logs for web shells, reverse shells, tunneling, or unusual commands.
• Check whether firewall configurations or managed-device settings changed.
• Rotate credentials if the FMC system was vulnerable during the exploitation window.
• Investigate before rebuilding so evidence is not accidentally destroyed.

Here’s the problem: once attackers gain control of firewall management, they may not need to fight through every other security layer. They can use the trusted management system to reach deeper into the network.

That is how unpatched network equipment can become the beginning of a ransomware incident.

What This Means for St. Louis-Area Small Businesses

These stories may involve Microsoft, MikroTik, F5, and Cisco, but the local lesson is straightforward.

Attackers look for overlooked systems.

That could be a Windows laptop in Chesterfield, a router in an O’Fallon retail shop, a remote-access appliance serving a Clayton office, or a firewall managing a medical practice in St. Charles County. It could also be a system connecting your Missouri business to employees in the Metro East.

Start with these questions:

• Do you know every router, firewall, server, and remote-access device you own?
• Which systems are exposed to the public internet?
• When was each device last patched?
• Who reviews administrative accounts and configuration changes?
• Can you detect suspicious behavior that does not create a new file?
• Have you tested your backups against a ransomware scenario?

You do not need to answer every technical question alone.

Platinum Web Services provides St. Louis IT support for small business, proactive patch management, network security, ransomware protection, and Missouri managed IT services designed around your actual environment.

We support businesses seeking managed IT services in Missouri with custom planning, security monitoring, and 24/7 IT support when an emergency cannot wait until Monday morning.

If you would like a second set of eyes on your network, visit our why choose managed IT page or contact Platinum Web Services.

Our office is located at:

Platinum Web Services
7827 Town Square Ave, 104-1184
O’Fallon, MO 63368

The front door still matters. But now you know to check the windows, the network closet, the router, and the systems managing your security.

Accuracy note: This news roundup summarizes vendor advisories and public reporting available as of September 13, 2026. Confirm affected versions, fixes, and incident-response steps with the relevant vendors and your IT security team before making changes.