Cybersecurity update: website-hijack campaign, two Windows zero-days, and MikroTik router flaws

A short roundup of three cybersecurity developments from the week of 8 September 2026 that matter to small and medium businesses, with plain-English context and practical next steps. Each item links directly to the original advisory so you can verify the details.

1. “ClickFix” attacks are hijacking small-business websites

What happened. Researchers at Netskope Threat Labs and Cisco Talos describe an ongoing “ClickFix” campaign that compromises legitimate websites — many built on WordPress and PrestaShop — and shows visitors a fake “CAPTCHA” that tricks them into pasting a malicious command into Windows. Netskope reports the campaign has been linked to more than 5,400 compromised websites. (These figures describe compromised websites, not confirmed infections.)

Who is affected. Any business that runs a website — especially on WordPress or PrestaShop — and any team whose staff browse the web on Windows PCs.

Why it matters. A compromised site can quietly attack your own visitors and customers, and the “paste this to continue” trick bypasses many traditional defences because the victim runs the command themselves.

• Keep your CMS, themes and plugins updated, and remove unused plugins.
• Have your website checked for injected scripts, unknown plugins or web shells.
• Train staff never to paste commands into the Windows Run box or PowerShell because a web page told them to.

Sources: Netskope Threat Labs research (via BleepingComputer) and Cisco Talos.

2. Microsoft patched two Windows zero-days already under attack

What happened. Microsoft’s September 2026 security updates fix two vulnerabilities that were already being exploited in the wild: CVE-2026-81963 (Windows Update Stack) and CVE-2026-85880 (Windows ALPC). Both let an attacker who already has a foothold raise their access to SYSTEM level. The Canadian Centre for Cyber Security published advisory AV26-896, and CISA added both flaws to its Known Exploited Vulnerabilities catalogue.

Who is affected. Businesses running Windows PCs and Windows Server.

Why it matters. “Elevation of privilege” flaws are how attackers turn a small break-in into full control of a machine. Because these were exploited before patches existed, prompt updating is the main protection.

• Apply the September 2026 Windows updates across desktops and servers as a priority.
• Confirm updates actually installed, especially on machines that are rarely rebooted.

Sources: Canadian Centre for Cyber Security — AV26-896 and Microsoft Security Update Guide.

3. MikroTik routers targeted through actively exploited flaws

What happened. The Canadian Centre for Cyber Security (alert AL26-020 and advisory AV26-887) and CISA warn that vulnerabilities in MikroTik RouterOS (including CVE-2026-67277 and CVE-2026-86060) are being exploited in the wild, especially where the SSH service is exposed to the internet. MikroTik has released fixed versions: 6.49.21, 7.23.4, 7.24.2, or 7.25 beta 3.

Who is affected. Any business using MikroTik RouterOS devices as routers or firewalls.

Why it matters. A compromised router can expose your whole network, intercept traffic, and provide a foothold for further attacks.

• Check the RouterOS version on each device and update to a fixed version.
• Do not expose SSH or management interfaces directly to the internet.
• Review authentication and network logs for signs of unauthorised access.

Sources: Canadian Centre for Cyber Security — AL26-020 and AV26-887.

How Techloom can help

These three items share a common thread: keep systems patched, keep management interfaces off the public internet, and help staff recognise manipulation. If you would like a clear picture of where your business stands, Techloom can assess your devices, networks and security practices and prioritise improvements within an agreed scope.

Request a cybersecurity and network audit or get in touch with Techloom.

This article summarises third-party advisories current as of 16 September 2026 and links to the original sources. Verify version numbers and applicability for your environment before acting.