Nine Licences Fall, Sanctions Desks Strain On Two Fronts

Attackers are gaining full administrative control of MikroTik routers by reaching the device's Secure Shell service directly from the internet, according to The Hacker News reporting on the campaign. No password is required. The technique is not a novel exploit chain against a patched flaw; it is SSH left reachable on the public interface with no access-list restriction, which MikroTik's own hardening documentation has told operators to close for years. The distinction that matters here is between a vulnerability disclosure and a configuration audit finding. This one is the second kind, and it does not get a CVE number to make it easier to track.

An HKMA-regulated bank running MikroTik gear at a branch, ATM backhaul link, or vendor site inherits this as a Technology Risk Management Guideline finding, not a patch-Tuesday item: TRM's expectation that remote administrative interfaces sit behind network segmentation and are not internet-facing applies whether or not a CVE exists. The audit question is not "are we patched" but "which of our routers answer SSH on the WAN port right now," a question a vulnerability scanner tuned for CVE matching will not surface. CVE-2025-6205 and CVE-2026-16232 above are both authentication-bypass flaws in named products with KEV dates; this MikroTik campaign has no such anchor and is easier to miss for exactly that reason.

No vendor patch resolves this because there is no vulnerable code path to patch. The control that would have changed the outcome is a firewall rule restricting SSH access to a management VLAN, plus disabling the service entirely on units that do not need remote administration. A bank's network team should be running an external port scan against its own MikroTik fleet this week, not waiting on a MikroTik advisory that will not arrive.

A tour guide and the two agencies behind her got their licences pulled today. This is the same guide from a few weeks back, the one who cornered a tour group and threatened them until they bought jade. Three strikes and you're out, and today the Travel Industry Council finally said "out."

Here's the thing worth knowing: this system usually looks slow and toothless, three warnings, paperwork, more warnings. But it ends somewhere. The guide's badge is gone. So are the agencies that kept sending her out. Compare that to the driverless car rules from last week, five clean years before a human can even sit next to the machine. One system waits five years to trust you. The other took three strikes to stop trusting you. Same government, two very different clocks, and today you got to see one of them actually run out.

North Korea commissioned its second nuclear-capable destroyer on September 6, 2026, timed to the opening day of a joint US-Japan-South Korea drill, and the US Treasury's Office of Foreign Assets Control is the desk that has to price it, not the Pentagon. OFAC's North Korea sanctions program has spent the past two years chasing the same problem it now has a second hull to show for: a shipbuilding effort funded substantially through crypto theft and ship-to-ship transfers that the existing designations were built to choke off and plainly have not. The same week, the US, UK, France and Germany moved to refer Iran to the UN Security Council over blocked nuclear inspections, the first such referral in two years, according to the coalition's own framing of the move.

Two enforcement tracks, one desk logic: sanctions regimes built to deter through designation lists are being tested simultaneously by a nuclear-adjacent naval commissioning in the Pacific and a Security Council referral in the Gulf, and neither program was designed to run at full capacity on two fronts at once. Or, more precisely, OFAC's North Korea unit and the State Department's Iran referral team draw on the same interagency sanctions-drafting capacity, which means a resourcing choice made in Washington this month, not a strategic one, decides which regime gets the sharper follow-through. The destroyer is already commissioned. The Security Council referral vote is not yet scheduled, and that is the date that tells you which track Washington actually prioritized.

Taiwan's Ministry of National Defense counted 17 People's Liberation Army vessels operating around the island in the 24 hours ending September 7, 2026, alongside aircraft crossing the median line of the Taiwan Strait, a boundary Beijing has not formally recognized since 2020. The count is a number, not a novelty. Taipei's ministry has logged similar patrols through 2025 and into 2026 without pause, and the routine is the point: a presence that no longer requires a press release to register as normal.

What changes is not the ship count. It is the baseline against which Washington, Tokyo, and Taipei now have to measure any future spike, because a fleet this size has already been absorbed into what counts as an ordinary Sunday in the Strait. North Korea commissioned its second nuclear-capable destroyer on September 6, 2026, timed to the start of a joint US-Japan-South Korea drill, and the pairing matters more than either event alone: two Indo-Pacific militaries are demonstrating hardware in the same week, and neither needed the other's provocation as an excuse. The next Taiwan Strait number that matters will not be a ship count. It will be whichever side changes the count enough that the other has to say so out loud.