Old D-Link routers are being hijacked via a zero-day vulnerability, known as CVE-2026-0625, which allows attackers to remotely execute commands. No patch is currently available.