Arista published four security advisories for Arista EOS on September 9, including an unauthenticated RCE rated CVSS 10.0 via P4Runtime (CVE-2026-73453) and two code-execution flaws in the gNPSI telemetry interface. No active exploitation is documented yet, but patching must come before the control plane is ever exposed.

On September 9, 2026, the first OpenSSL 4.1 alpha enabled DTLS 1.3 — shorter handshakes, forward secrecy and built-in post-quantum crypto — plus GREASE, the mechanism that stops middleboxes from ossifying TLS. For anyone running gateways, IoT fleets or UDP-based services, it is the signal to start planning the migration.

The September 8, 2026 Patch Tuesday fixes nine remote code execution flaws in Windows DNS Server, including CVE-2026-69730, a CVSS 9.8 use-after-free triggerable with a single forged packet. Patch the servers running the DNS role first and segment port 53 before a public exploit appears.

NEC fixes CVE-2026-16876, a critical missing-authentication flaw (CVSS 9.4) in the WebGUI of UNIVERGE IX-R and IX-V enterprise routers: a forged message bypasses login and runs arbitrary CLI commands. Apply the firmware update, or disable the WebGUI if it is reachable from the internet.

CERT Polska warns that attackers are taking full administrative control of MikroTik routers whose SSH service is reachable from the internet, without authentication. Update RouterOS and audit the configuration before putting any device back into service.

Rapid7 Labs documents “ted”, an implant compiled directly into HAProxy 2.8.12 at two South Korean companies that intercepts web traffic and erases its own connections from the load balancer’s counters. It requires a prior compromise of the host — verify the integrity of your edge binaries and watch connection counters instead of waiting for an HAProxy patch.

On September 2, 2026, Cisco bundled seven internally discovered IOS XR vulnerabilities into seven CVEs grouped by CWE class, including two at CVSS 9.8 that affect every release of the core-router operating system. Apply the SMUs in your maintenance windows rather than waiting for releases 26.2.2 and 26.3.1.

On 2 September 2026 Cisco disclosed CVE-2026-20212, a CVSS 9.8 flaw that leaves TCP ports 43210 and 43211 on ten Nexus 9000 switches reachable for unauthenticated remote code execution as root. Apply an iACL on both ports and the Live Protect lp00031 shield now, then check your release in the Software Checker.

Between August 28 and 30, 2026, attackers hijacked Softaculous’s 162.55.80.0/24 range to deliver a trojaned Virtualizor update to live hypervisors. Every Virtualizor operator should check for the java-jre-update.service, rotate credentials, and demand signed updates.

On September 1, 2026, Cloudflare detailed Cache Transcoding, a prototype that compresses eligible assets with Zstandard directly inside Pingora. Encoding shrinks on-disk size to roughly a third, for a few points of CPU, and cuts bandwidth between data centers.

Wi-Fi 8 (IEEE 802.11bn) is the first wireless generation that no longer tries to break a throughput record: with the same theoretical top speed as Wi-Fi 7, it targets bounded latency and “ultra-high reliability” in dense environments. The first Qualcomm and Broadcom products land in late 2026, but most users can ignore them until 2028.

On October 11 2026 the DNSSEC root Key Signing Key moves from KSK-2017 to key tag 38696 (KSK-2024), and the old key is retired in January 2027. Operators of validating resolvers must confirm tag 38696 is installed before the cutover, or their DNS resolution will fail wholesale with no network symptom.

On 18 August 2026, a fire at a Moscow power plant cut electricity to MMTS-9, the building that hosts the core of MSK-IX, Russia’s main internet exchange point; Discord, Steam, Telegram and the country’s mobile carriers went down with it. The incident confirms a twenty-one-year-old warning: concentrating interconnection in one place is fragile design.

An out-of-bounds write in the Linux kernel’s IPv6 UDP fragment handling, rated CVSS 7.8, lets a local attacker escalate privileges and is already being exploited — CISA added it to the KEV catalog on 27 August 2026. Patch the kernel before 30 August and treat IPv6 as something you monitor, not just route.

The US Justice Department and FBI announced the takedown of a network of SOHO routers compromised by Russia’s GRU, which was hijacking DNS lookups to intercept credentials and encrypted email. The lesson in one line: the home router has become the intelligence services’ preferred interception point, and it must be defended like an attack surface.

On August 26, 2026, the U.S. Department of Justice and the FBI seized the domains of QScan and QTRouter, two platforms run by a Chinese group that concealed the origin of intrusions against U.S. critical infrastructure. The lesson outlives the news cycle: network obfuscation is now an industrialized service, and it breaks where the attacker has the least redundancy.

On August 18, 2026, Cloudflare published its measurement of RFC 9234 adoption, the BGP Role and OTC mechanism that catches route leaks at the source. The finding is blunt: support varies widely by vendor, and the OTC attribute only stops a leak if the whole path preserves it.

Two flaws published on August 19, 2026, CVE-2026-71960 and CVE-2026-71961, let an accountless attacker forge an MQTT token and then run root commands on the Cudy WR3000 mesh router. Update to firmware 2.5.24 and take the mesh interface off your internet exposure.

On August 19, 2026, Cisco shipped a "hardening" release for Crosswork that neutralizes four vulnerabilities rated CVSS 10.0, without detailing a single one of them. Network operators must patch their management plane blind, on trust rather than on facts.

On August 14, 2026, a RIPE NCC member published a field report on an IPv6-first EKS deployment on AWS: roughly $143 a month per environment saved, against a dated list of dependencies still stuck on IPv4. Teams standing up a new cluster now have an objective criterion for choosing IPv6-first over dual-stack.

CableLabs warned on August 18, 2026 that legacy Wi-Fi clients do not reliably ignore security options they fail to recognize, and some can no longer join a Wi-Fi 7 access point. The fix exists — WPA3-Personal Compatibility Mode and RSNO elements — but it downgrades clients that do not implement it to Wi-Fi 6.

A survey published in IEEE Communications Surveys & Tutorials maps BGP attacks into four families and eight subcategories. RPKI and ASPA only cover two of them; the other four rest on unverifiable local filters, as the May 20, 2025 Prefix-SID incident demonstrated.

CISA added CVE-2026-33824, a remote code execution flaw in Windows IKE, to its Known Exploited Vulnerabilities catalog on August 18, 2026 — four months after Microsoft shipped the fix. Network teams must patch exposed IPsec gateways or block inbound UDP 500 and 4500 now.

The Iranian Cavern C2 framework has added a module that queries DNS to choose between a direct HTTPS channel and a Google Apps Script relay, plus another that turns Microsoft 365 calendars into a dead-drop. For network detection, indicator blocklists are no longer enough: you have to watch for anomalous DNS queries and abuse of legitimate services.

RPKI validates the origin of a BGP announcement, never its path. PeerCortex measurements from August 2026 show 99% of route leaks detected over 90 days traveled paths with no ASPA coverage, deployed on just 3% of ASNs. Publishing your ASPA records takes thirty minutes.

The Mirai-derived modular botnet Evooo1Bot has been recruiting internet-exposed gateways — Alcatel, NETGEAR, Tenda, D-Link — into resellable SOCKS5 relay nodes since July. Fortinet documents a full arsenal whose economic novelty, the residential relay, should push every operator to inventory their internet-facing routers.

On August 12, 2026, a malformed default route propagated by a route reflector at hosting provider TeraSwitch knocked 28.83% of staked SOL offline, within 4.51 points of Solana’s finality halt threshold. The lesson goes beyond blockchains: measure your ASN concentration and actually test your failover.

On August 13, 2026 a federal judge approved the settlement between HPE and the US Department of Justice, ending a two-and-a-half-year regulatory saga over Juniper Networks. For network teams, the HPE–Aruba–Juniper combination redraws the enterprise switching and Wi-Fi market against Cisco and Arista.

Cloudflare’s H1 2026 DDoS report documents an explosion of hyper-volumetric attacks and reflection vectors built on DNS and CLDAP. Attacks now last seconds, which makes manual mitigation structurally obsolete.

In August 2026 Cisco disclosed CVE-2026-20349, an 8.6 CVSS flaw in the SSL VPN of its ASA and FTD firewalls: one unauthenticated HTTP request forces the device to reload and drops VPN access for every remote worker. With no workaround available, patching is the only fix — and the flaw is already being exploited in the wild.

Poland's CERT revealed on August 10, 2026 that a threat actor used a misconfigured private APN to compromise a combined heat-and-power plant serving 50,000 residents. This is the first documented OT attack using an APN as a lateral movement vector.

CISA added **CVE-2026-8037** to the KEV catalog on **August 7, 2026** — the command injection flaw in Progress Kemp LoadMaster is under active exploitation by ransomware gangs. Patch now before your load balancer becomes your infrastructure's front door for attackers.

On August 5, 2026, Cisco shipped a massive hardening release for IOS XE and SD-WAN, bundling fixes for 12 vulnerabilities uncovered during an internal AI-assisted security review. Three reach CVSS 9.9. The era of AI-accelerated vulnerability discovery has hit the network hardware industry — and Cisco just showed what that looks like in production.

A use-after-free bug in the Linux kernel’s SCTP stack, dormant for 18 years and now tracked as CVE-2026-64564, lets a local attacker escalate to root and escape containers. Patches landed August 4, 2026 — kernel updates are not optional.

On August 6, 2026, researcher Malcolm Stagg presented NatJack at Black Hat USA — a new attack class that manipulates NAT connection state to hijack active TCP sessions, spoof DNS responses, expose mapped ports, and exhaust NAT tables. Windows, Linux, and consumer routers are all vulnerable — because the flaw is in the concept of NAT itself, not any one implementation.

Microsoft attributes a global hotel Wi-Fi compromise campaign to APT29. The ChocoShell and CornFlake malware strains harvest M365 sessions from business travelers connecting to the lobby network.

On August 6, 2026, the Linux WiFi maintainer announced a three-second rejection rule for AI-generated patches, as the networking subsystem continues to be flooded with automated contributions. Open-source network infrastructure maintainers are raising the alarm: code quality is at risk.

Mysk researchers identified three WebKit features that bypass proxy configuration on iOS and macOS, exposing users' real IP addresses and DNS servers. The leaks affect all iOS proxy browsers, Tor Browser, and Apple's iCloud Private Relay.

On August 3, 2026, CISA issued an urgent alert after attackers disrupted more than 30 community water systems in Minnesota within 48 hours. The attackers targeted internet-exposed programmable logic controllers (PLCs), changed passwords, and disconnected equipment from the network. Censys counts over 10,000 Rockwell, Siemens, and Schneider PLCs publicly accessible.

On July 31, 2026, a European cloud operator's prefix was hijacked for four hours via a fraudulent BGP announcement originating in Southeast Asia. RPKI and ROV would have stopped the incident in 87 seconds — yet nearly half of all IPv4 prefixes globally still lack protection.

Researchers from Singapore's NTU discovered 84 vulnerabilities across seven open-source LTE and 5G core implementations. The root cause is identical everywhere: network functions trust every internal message blindly, and the move to cloud-native deployments made those interfaces reachable from the internet.

MQTT rules industrial IoT, AMQP powers RabbitMQ 4.x, and NATS is taking over cloud-native messaging. Here is how these three protocols coexist in 2026 network architectures.

Your APIs aren’t internal plumbing anymore — they’re your products. An API Gateway centralizes the rate limiting, authentication, caching, and analytics that every microservice would otherwise have to reinvent in its own code. Kong, Traefik, and Tyk embody three distinct architectures: here’s how to pick the one that won’t slow you down.

Nmap 7.99, masscan, and RustScan represent three distinct network scanning philosophies. A pentester doesn’t pick one: they combine all three to map their attack surface before someone else does it for them.

The MEF published the MEF 70 standard in July 2019, Broadcom acquired VMware VeloCloud in November 2023, and FlexiWAN crossed 4,000 accounts in 2025 with open-source SD-WAN. The SD-WAN market hit $3.4 billion in 2024 and is projected to reach $13.7 billion by 2028 according to Gartner — here is why your MPLS contract is becoming a subscription to a horse-drawn carriage.

Attackers can wipe logs, tamper with timestamps, and kill your EDR. They can’t make the packets that crossed your network disappear. Here’s how to capture them, dissect them, and turn them into unassailable evidence using three essential tools.

Your users are in Tokyo, your server is in Paris — a CDN puts your pages 10 ms away from them. With Varnish or Apache Traffic Server on three $5 VPS instances, you get the same latency as BunnyCDN or Cloudflare, without a bandwidth bill that scales with your success.

Zabbix 7.0 LTS, Checkmk 2.5, and LibreNMS 26.7 are the three pillars of open-source network monitoring in 2026, and their architectures cover every budget. The right tool depends less on your wallet than on how many devices you need to monitor and how much engineering time you can invest.

HAProxy 3.4 brings dynamic backends with zero-downtime reloads, Traefik 3.7 auto-discovers your containers, and Envoy 1.39 powers Google’s service mesh. Here’s which one to pick and how to configure it for speed instead of drag.

OpenSSH 10.4 shipped in July 2026, multiplexing saves 5 seconds per connection, and SSH certificates have been replacing authorized_keys since 2010 without anyone noticing. If you're still typing passwords to reach your servers, this article is for you.

Cloudflare absorbs 500 Tbps of network traffic and OVHcloud protects every server against attacks up to 1.3 Tbit/s at no extra cost. The difference between DNS amplification and Slowloris changes everything about how you choose your protection.

Ansible, Nornir, and Netmiko turn your network into infrastructure-as-code with Git history, automatic rollback, and drift detection in 2026. Past five devices, automation pays for itself within a month.

802.1Q VLAN turned 27 in 2025, and 94% of ransomware attacks still exploit lateral movement through unsegmented networks. VLAN, VXLAN, micro-segmentation, and 802.1X are not exotic checklist items — they are the four locks that determine whether a single compromised endpoint becomes a full organizational disaster.

Istio 1.29.2, Linkerd 2.19, and Cilium 1.18 all promise mTLS, observability, and traffic splitting for your clusters. The real question is which one operates without a dedicated platform team.

Google measured 49.62% native IPv6 traffic as of July 26, 2026, yet most enterprise network teams still treat IPv6 as a future project. Your network is likely already dual-stack without you having configured it — and that’s the real problem.

Wi-Fi 7 certification was finalized in January 2024, enterprise access points from every major vendor have been shipping since early 2026, and the 6 GHz spectrum delivers 1,200 MHz of untouched bandwidth. If your office runs more than thirty devices on Wi-Fi 5 or 6, the bottleneck isn’t your fiber connection — it’s the air between the access point and the desk.

iptables is 25 years old in 2026 and relies on O(n) sequential rule chains that collapse at a few thousand entries. eBPF injects verified, JIT-compiled bytecode directly into the Linux kernel, and Cilium builds on that to route, secure, and observe Kubernetes traffic without kube-proxy.

Private 5G (NPN) uses dedicated spectrum at 3.7 GHz, network slicing, and edge computing to deliver one-millisecond latency to factories, ports, and stadiums. If your wireless infrastructure handles moving equipment or real-time control loops, Wi-Fi is no longer the right answer.

DN42 counted over 1,800 AS numbers and 12,000 announced prefixes as of April 2026. BIRD 2.16 and FRRouting 10.2 make BGP peering accessible from a single Docker container, and a /48 IPv6 prefix takes under 30 lines of config to announce.

As of 2026, nearly all DNS traffic still travels unencrypted over your ISP’s network, where it gets packaged and sold to programmatic ad exchanges. DoH, DoT, and the new DoH3 protocol make that surveillance technically impossible.

NIST published SP 800-207 in August 2020, the Biden administration mandated Zero Trust for all US federal agencies in January 2022, and Google has been running BeyondCorp internally since 2011 without a VPN. If your network security still relies on the assumption that a packet is clean because it originated on the LAN, you have already lost.