Zyxel GS1900 Zero-Day: Patch 3 Fixes Bypassed Bug

**Zyxel GS1900 patch gap and active exploit:** A parameter-handling bug in dispatcher.cgi led to two tracked CVEs (CVE-2026-7273 and the zero-day CVE-2026-107441) that allowed unauthenticated remote command execution as root; a single actor exploited the issue in August to collect configurations and hashed root credentials from roughly 996 switches across 48 countries. Patch 2 released in June left a size-check gap that Patch 3 (released Oct 23) fixes; affected owners should upgrade to Patch 3, restrict management access, change default/root credentials, and review devices for compromise.