PHP2Shell: Critical Vulnerabilities Actively Exploited Two critical PHP vulnerabilities, CVE-2026-1096118 and CVE-2026-1096119, both scored 9.8 out of 10, were patched on 21 October 2026. Within hours, attackers began probing for unpatched servers. These flaws allow unauthenticated remote code execution on vulnerable PHP installations, affecting WordPress, WooCommerce, Magento and countless UK small business websites. The vulnerabilities involve memory corruption and stale global state handling. Emergency patches are available for PHP 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Cloudflare reported early exploit attempts the same day patches released. CrowdStrike and SentinelOne published guidance immediately. No confirmed breaches have been publicly reported, but absence of disclosure does not mean absence of compromise. UK small businesses must verify their PHP version today, contact hosting providers or MSPs for patch confirmation, and obtain written evidence of remediation. This episode provides specific, actionable steps for business owners to protect their web infrastructure and strengthen their Cyber Essentials certification posture. Chapters Intro Corrine introduces two critical PHP vulnerabilities with 9.8 severity scores, already being actively exploited following patch release. PHP2Shell: Active Exploitation of Critical Web Vulnerabilities Detailed examination of CVE-2026-1096118 and CVE-2026-1096119, covering what PHP is, who’s affected, the technical nature of the memory corruption flaws, the timeline of exploit attempts, and specific remediation steps for UK small businesses. CTA Request for listeners to follow, rate and share the show within the small business community. Outro Summary of immediate actions required: contact server management provider, verify PHP version, obtain written confirmation of patching. Links https://thehackernews.com https://www.darkreading.com https://www.cloudflare.com https://www.crowdstrike.com https://www.sentinelone.com https://www.calif.io https://www.wiz.io https://openai.com https://www.quarkslab.com
Plex Media Server Under Active Attack: Four Chained Vulnerabilities On 20 October 2026, CISA added four Plex Media Server vulnerabilities to its Known Exploited Vulnerabilities catalogue, confirming active exploitation in the wild. The vulnerabilities can be chained together to achieve remote code execution on unpatched systems. This episode walks through the technical detail of each CVE (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656), explains how attackers exploit server-side request forgery and file write flaws to gain administrative access, and provides actionable steps for UK small businesses. Also covered: a DLL sideloading vulnerability in Siemens Software Center exploited via ClickFix social engineering attacks, and the operational implications of autonomous AI-driven scanning at scale. Patches for all discussed vulnerabilities are available. This episode emphasises the importance of treating personal software that sits on business networks with the same urgency as enterprise systems, and provides clear remediation steps for organisations holding Cyber Essentials certification. Chapters Introduction Corrine introduces the lead story: four actively exploited vulnerabilities in Plex Media Server, a media streaming application widely installed on business networks without formal oversight. Plex Media Server: Four Vulnerabilities, One Dangerous Chain Detailed technical breakdown of CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, and CVE-2026-96656. Explains how server-side request forgery, improper URI handling, and file write vulnerabilities can be chained to achieve remote code execution. Covers proof-of-concept availability, patch status, and specific remediation steps including port closure and update verification. Call to Action Brief request for listeners to follow, rate, review, and share the show with other small business owners. Siemens Software Center and the ClickFix Threat Examination of CVE-2026-110936, a DLL sideloading vulnerability in Siemens Software Center actively exploited via ClickFix social engineering. Explains the attack technique, remediation requirements, and staff awareness protocols to mitigate similar threats. Autonomous AI Attacks and the Volume Problem Analysis of confirmed Chinese-speaking criminal operation using autonomous AI agents to attack over 1,200 websites with minimal human involvement. Discusses the operational implications for small businesses when attack economics shift towards high-volume, low-cost automation. What to Do This Week Consolidated action list: locate all Plex installations across the network, apply available patches, audit port exposure, confirm Siemens Software Center updates, and brief staff on ClickFix recognition and response. Outro Corrine summarises the key operational takeaway: personal software on business networks requires the same patch discipline as enterprise systems. Signposts show notes and tomorrow’s episode. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Rank Math PRO Supply Chain Attack and H3C Router Exploits On 20 October 2026, two critical security incidents demand immediate attention from UK small businesses. First, a supply chain attack compromised Rank Math PRO, a widely used WordPress SEO plugin, delivering malware through legitimate update channels during an eleven-hour window on 15-16 October. The malware establishes persistent backdoors, exposes credentials, and rebuilds itself on page visits, requiring full site investigation rather than simple file deletion. Second, two vulnerabilities in the H3C Magic NX15 router, both scoring 9.9 on the CVSS scale, enable unauthenticated remote code execution with publicly available exploits. These incidents target precisely the infrastructure small businesses install and forget: plugins on automatic update and network hardware left unpatched for months or years. Neither attack required sophisticated access. Both exploited the gap between deployment and ongoing oversight. This episode provides practical guidance on checking WordPress update logs, investigating compromised sites, auditing router firmware, and building the basic asset inventory that transforms reactive panic into measured response. The common thread is inattention to background infrastructure, and the fix is process, not technology. Chapters Intro Corrine introduces the episode and frames two active compromises: one targeting WordPress sites, one targeting network infrastructure. Neither provided advance warning, and both exploit the gap between deployment and ongoing oversight. Rank Math PRO Supply Chain Attack Detailed analysis of CVE-2026-111862, a supply chain attack on Rank Math PRO WordPress plugin. Between 15-16 October 2026, malware was distributed through legitimate update channels during an eleven-hour window. The malware establishes persistent backdoors, contacts command-and-control infrastructure, rebuilds itself on page visits, and exposes WordPress and database credentials. Affected sites require full compromise investigation, not simple file deletion. Guidance provided on checking update logs, auditing sites, rotating credentials, and the competitive value of proactive oversight for agencies. CTA Brief call to action encouraging listeners to follow the show, leave reviews, and share the episode with others who manage WordPress sites or network infrastructure. H3C Magic NX15 Router Vulnerabilities Examination of two critical vulnerabilities in the H3C Magic NX15 router, CVE-2026-112370 and CVE-2026-112371, both scoring 9.9 on CVSS. Both enable unauthenticated remote code execution via OS command injection and code injection flaws, with public exploits already in circulation. Routers in attacker hands sit at network boundaries, enabling traffic interception, connection redirection, and persistent access. Practical guidance on identifying affected devices, checking for firmware updates, restricting internet-accessible admin interfaces, and building a basic network device inventory. Outro Corrine closes by emphasising the common thread: both incidents exploited infrastructure that businesses deployed, trusted, and stopped monitoring. The fix is ongoing oversight through basic processes like checking update logs, knowing firmware versions, and maintaining asset inventories before incidents occur. Links https://rankmath.com https://rank1cdn.com
Hardcoded Credentials and Drupal RCE: Two Critical Patches You Need Today Two critical vulnerabilities disclosed in the last 48 hours demand immediate attention from UK small businesses. CVE-2026-111998 affects Vanus event infrastructure with a severity score of 9.8, exploiting a hardcoded Bearer token that grants cluster-admin access to unauthenticated attackers. No password guessing or phishing required: the credential was baked into the software from deployment. Separately, Drupal’s security team has warned of two remote code execution vulnerabilities affecting all supported versions, with exploits expected within hours or days of disclosure. Both vendors have issued patches. The gap between disclosure and exploitation continues to shrink, and automated scanning does not discriminate by company size. This episode provides operational guidance on checking your environment, contacting managed service providers, and implementing defensible patch management processes aligned with NCSC guidance and Cyber Essentials requirements. Corrine walks through the technical mechanics, the practical risks to customer data and regulatory compliance, and the documented steps you need to take today. Chapters Intro Corrine introduces two critical vulnerabilities disclosed in the last 48 hours, both exploitable without credentials or user interaction, and both with available patches. CVE-2026-111998: The Password That Was Never a Secret A 9.8 severity vulnerability in Vanus versions 0.8.0 through 0.9.0, exploiting a hardcoded Bearer token that grants cluster-admin access to unauthenticated attackers. Guidance on checking your environment and contacting managed service providers. CTA A request to follow, rate, review, and share the show with other small business operators who need practical cybersecurity intelligence. Drupal: Two Critical RCE Vulnerabilities Two remote code execution vulnerabilities in all supported Drupal versions, including CVE-2026-108097 in the Field UI module. Vendor warning that exploits could appear within hours or days. Operational guidance on same-day patching and confirming managed hosting provider response. The Pattern Behind Both Vulnerabilities Analysis of the common pattern: software shipped in an insecure state, vendors issuing patches, and organisational liability beginning at the point of disclosure. Discussion of NCSC and ICO expectations, and the shrinking gap between disclosure and exploitation. Outro Summary of required actions: check for Vanus and Drupal in your environment, obtain written confirmation from providers, and establish a documented patch management process using free NCSC guidance. Links https://nvd.nist.gov/vuln/detail/CVE-2026-111998 https://www.drupal.org/security https://www.ncsc.gov.uk/collection/vulnerability-management https://www.ncsc.gov.uk/cyberessentials/overview
Active Exploitation, Perfect Scores, and Hard-Coded Camera Backdoors Three critical vulnerabilities demand immediate attention from UK small businesses this week. CISA has confirmed active exploitation of CVE-2026-21589, affecting eight Atlassian products including Confluence and Jira, allowing unauthenticated attackers to access internal files. CVE-2026-110957 scored a perfect 10.0 CVSS rating for a Wavlink router flaw enabling complete remote compromise without authentication. Meanwhile, CVE-2026-111281 exposes Jooan security cameras shipping with permanent, unchangeable backdoor credentials. All three vulnerabilities share a critical pattern: they bypass authentication entirely, meaning multi-factor authentication offers no protection. Corrine examines what this pattern reveals about structural failures in budget hardware and enterprise software, the immediate remediation steps required for each vulnerability, and why documented patch management has become commercially valuable. The episode provides specific questions to put to IT providers in writing, explains how these vulnerabilities affect supply chain risk assessment, and outlines the evidence procurement teams increasingly require from suppliers. Chapters Introduction Corrine introduces three urgent vulnerabilities: one confirmed under active exploitation, one scoring a perfect 10.0 severity rating, and one involving security cameras shipping with permanent manufacturer backdoors. The Atlassian Exploit That Is Already in the Wild CVE-2026-21589 added to CISA’s Known Exploited Vulnerabilities catalogue affects eight Atlassian products. Unauthenticated attackers can access internal files without credentials. Corrine explains the supply chain implications, CISA’s mandatory remediation guidance, and the specific questions to ask IT providers today. Call to Action Corrine requests listeners follow the show, leave ratings and reviews, share with other small business owners, and provide feedback that shapes future episode coverage. A Perfect Score for Your Office Router CVE-2026-110957 in Wavlink WL-WN530BE2-A routers received CVSS 10.0, reflecting network-accessible, unauthenticated remote command injection. A patch exists, but the episode examines who is actually responsible for applying firmware updates and how to verify that process exists. Hard-Coded Credentials in Your Security Cameras CVE-2026-111281 affects Jooan JA-A12 IP cameras shipping with permanent, unchangeable backdoor credentials enabling full device compromise. Corrine discusses the irony of security devices creating attack surfaces and the assessment required when no patch is available. The Pattern Underneath All Three All three vulnerabilities enable unauthenticated access, bypassing login screens entirely. Corrine explains why this structural pattern matters more than individual flaws and why patch management trumps multi-factor authentication for this threat class. How Staying Current Becomes a Competitive Advantage Documented patch records satisfy increasingly common supplier security questionnaires in public sector procurement and enterprise contracts. Genuine security and its documentation are the same work, creating verifiable commercial value. Making the Case Internally Three points for budget conversations: CISA KEV represents confirmed attacks not theoretical risk, CVSS 10.0 has specific documented meaning, and firmware update failures indicate governance problems requiring organisational change. Conclusion Three actions before Friday: verify Atlassian remediation status in writing, check Wavlink router firmware versions, audit IP camera models and firmware. Document every outcome as the foundation of a commercially valuable patch record. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://nvd.nist.gov/vuln/detail/CVE-2026-21589 https://nvd.nist.gov/vuln/detail/CVE-2026-110957 https://nvd.nist.gov/vuln/detail/CVE-2026-111281 https://www.first.org/cvss/
MSP Backup Compromise, Cisco Email Flaw, and the 1,414-Patch Month On 14 October 2026, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalogue, three of which carry direct consequences for UK small businesses relying on managed service providers. The lead story concerns Ahsay Cloud Backup Server, where two chainable CVEs allowed attackers to bypass authentication and execute arbitrary commands on MSP backup infrastructure. Active exploitation began by 4 October, giving attackers a ten-day window before public disclosure. Cisco Secure Email Gateway also suffered a critical flaw allowing unauthenticated file writes to the underlying OS. Microsoft’s October 2026 Patch Tuesday crossed the four-digit threshold for the first time, releasing 1,414 patches in a single month. Four WordPress plugins require immediate attention for remote code execution and SQL injection flaws. This episode examines why backup infrastructure compromise is uniquely dangerous, what questions to ask your MSP this week, and how lack of visibility into third-party software creates material risk under UK GDPR. Corrine provides specific actions for businesses that outsource IT security and explains why documented MSP oversight is now a competitive differentiator in client security questionnaires. Chapters Introduction Corrine opens with urgent news that MSP backup software may already be compromised. CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalogue on 14 October 2026, with three carrying direct consequences for UK businesses using managed service providers. Ahsay Cloud Backup Server: The Compromise Your MSP May Not Know About Yet Two CVEs affecting Ahsay Cloud Backup Server allowed attackers to bypass authentication and execute arbitrary commands. Active exploitation began by 4 October, ten days before public disclosure. The vulnerabilities are chainable and target MSP backup infrastructure, with multiple organisations already compromised. Corrine explains why backup system compromise is uniquely dangerous and what questions to ask your MSP. Call to Action Corrine asks listeners to follow the show, leave reviews, and share the episode with business owners who outsource IT without understanding what software their MSP actually runs. Cisco Secure Email Gateway: No Login Required CVE-2026-76519 allows unauthenticated remote attackers to write arbitrary files to Cisco Secure Email Gateway appliances. The flaw affects devices specifically deployed to protect email and requires no credentials to exploit. Corrine discusses the pattern of perimeter security infrastructure becoming priority targets. October Patch Tuesday and the Volume Problem Microsoft’s October 2026 Patch Tuesday released 1,414 patches, the first time the monthly count crossed four digits. Kaspersky analysis confirms this as a milestone. Corrine examines whether MSPs can maintain adequate patching cadence as vulnerability volume accelerates. WordPress Plugins Under Active Threat Four critical WordPress plugin vulnerabilities require immediate action: Snazzy Social Media Feed, Abandoned Cart Pro for WooCommerce, AGE-GATE, and SimpleForm. Flaws include remote code execution, SQL injection, and privilege escalation, several requiring no authentication. Why This Gives You a Competitive Edge Corrine explains how documented MSP oversight creates competitive advantage in client security questionnaires. Under UK GDPR, businesses remain data controllers even when MSPs are processors, meaning liability for MSP infrastructure compromise flows upward. Specific visibility into MSP software inventory is a verifiable differentiator most competitors cannot provide. Conclusion Corrine provides specific questions to ask MSPs this week about Ahsay backup software, Cisco email gateway patching, and software inventory. She emphasises that these conversations require no budget, only the willingness to ask direct questions and expect direct answers. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.security.nl/ https://nvd.nist.gov/ https://www.kaspersky.com/
Ivanti VPN and Windows Shell Zero-Days Confirmed Exploited in the Wild On 14 October 2026, CISA confirmed active exploitation of two critical zero-day vulnerabilities: CVE-2026-104935 in Ivanti Connect Secure VPN and CVE-2026-96951 in Windows Shell. The Ivanti flaw allows complete authentication bypass and root-level command execution without credentials, whilst the Windows vulnerability permits command injection across the operating system. Both vulnerabilities were added to CISA’s Known Exploited Vulnerabilities catalogue, confirming they are being used in live attacks. Security firm Volexity reported attackers chaining the Ivanti flaw with two additional zero-days to achieve full system compromise and credential theft. Microsoft’s October Patch Tuesday addressed 1,413 CVEs in total, the largest single-month release on record. This episode examines the immediate risks to UK small businesses, the forensic challenges of detecting compromise, and the specific patching actions required under Cyber Essentials and GDPR frameworks. Additional critical vulnerabilities in Adobe Commerce and ColdFusion are also covered, with practical guidance for businesses running e-commerce platforms. Chapters Introduction: Patch Tuesday and Two Confirmed Zero-Days Microsoft releases fixes for 1,413 vulnerabilities, including two actively exploited zero-days confirmed by CISA: an Ivanti VPN authentication bypass and a Windows Shell command injection flaw. Ivanti Connect Secure Authentication Bypass (CVE-2026-104935) Analysis of the actively exploited Ivanti Connect Secure vulnerability allowing complete authentication bypass and root command execution. Covers Volexity’s research on threat actors chaining three zero-days, the forensic detection challenges, and specific patching requirements for UK businesses and MSPs. Listener Call to Action Request for podcast follows, ratings, reviews, and sharing with other business owners who need critical vulnerability intelligence. Windows Shell Command Injection (CVE-2026-96951) Examination of the Windows Shell zero-day included in October 2026 Patch Tuesday. Explains command injection mechanics, the scale of the 1,413-CVE release, and the 14-day patching requirement under Cyber Essentials certification. Adobe Commerce and ColdFusion Critical Vulnerabilities Coverage of maximum-severity flaws in Adobe Commerce, Adobe Experience Manager, and ColdFusion published alongside Patch Tuesday, including arbitrary code execution and changed-scope vulnerabilities affecting UK e-commerce operators. Business Impact and Patching Strategy Practical analysis of patching costs versus breach costs, MSP contractual obligations, regulatory requirements under GDPR and NIS Regulations, and the evidential value of documented patch confirmations. Actionable Steps and Closing Specific tasks for the week: confirming Ivanti patches and integrity checks, deploying Windows updates including servers, verifying Adobe Commerce patches, reviewing VPN logs, and maintaining written records for regulatory due diligence. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.volexity.com/ https://www.ivanti.com/ https://www.darkreading.com/ https://www.crowdstrike.com/ https://nvd.nist.gov/ https://helpx.adobe.com/security.html
Legacy Routers, WordPress Exploits, and the Compression of Patch Windows Three critical vulnerabilities disclosed this week share a dangerous common thread: all carry working exploit code in the wild, and attackers are moving faster than most UK small businesses can patch. This episode examines CVSS 10.0 flaws in legacy TRENDnet, Linksys, Edimax, and Netcore routers that will never receive security updates, an actively exploited unauthenticated code execution vulnerability in the Bricksforge WordPress plugin, and a SonicWall SMA 1000 server-side request forgery flaw that saw 135 documented exploitation attempts within days of disclosure. The episode provides specific guidance for UK SMBs on identifying affected hardware in their networks, checking WordPress plugin status, and asking direct questions of IT providers about patch deployment. The underlying pattern reveals a troubling reality: the window between vulnerability disclosure and active exploitation has compressed to the point where quarterly patch cycles represent an unacceptable security posture. Detailed CVE references, vendor statements, and actionable remediation steps are provided throughout. Chapters Introduction Opening examination of CVSS 10.0 vulnerabilities in legacy network equipment and the uncomfortable reality of end-of-life hardware still deployed in UK small business networks. Your Office Router May Have a CVSS 10.0 Flaw With No Patch Coming Detailed breakdown of critical vulnerabilities affecting TRENDnet, Linksys, Edimax, and Netcore routers, including OS command injection, buffer overflow, and authentication bypass flaws. Examination of vendor responses confirming hardware end-of-lifed in 2011 will receive no patches. Guidance on checking router support status and credential hygiene. Call to Action Request for listener engagement through ratings, reviews, and sharing with other small business operators. The Bricksforge WordPress Plugin Is Under Active Exploitation Right Now Analysis of CVE-2026-85097, an unauthenticated PHP code execution flaw in the Bricksforge WordPress plugin under active exploitation. Discussion of UK GDPR reporting obligations, reputational risk, and immediate remediation steps including plugin updates and security audits. SonicWall SMA 1000 SSRF Flaw Under Active Attack Examination of CVE-2026-102255, a server-side request forgery vulnerability in SonicWall Secure Mobile Access 1000 appliances. Discussion of 135 documented exploitation attempts within days of disclosure and implications for remote access infrastructure deployed during pandemic. The Pattern Underneath All Three Analysis of the common dynamic across all three vulnerabilities: public exploit code, compressed exploitation windows, and the inadequacy of quarterly patch cycles in the current threat landscape. Closing Recommendations Three specific actions for UK small businesses: checking router support status, updating WordPress plugins, and verifying SonicWall patch deployment with IT providers. Links https://nvd.nist.gov/vuln/detail/CVE-2026-108804 https://nvd.nist.gov/vuln/detail/CVE-2026-108892 https://nvd.nist.gov/vuln/detail/CVE-2026-108893 https://nvd.nist.gov/vuln/detail/CVE-2026-108894 https://nvd.nist.gov/vuln/detail/CVE-2026-108895 https://nvd.nist.gov/vuln/detail/CVE-2026-108896 https://nvd.nist.gov/vuln/detail/CVE-2026-108917 https://nvd.nist.gov/vuln/detail/CVE-2026-108918 https://nvd.nist.gov/vuln/detail/CVE-2026-108914 https://nvd.nist.gov/vuln/detail/CVE-2026-108915 https://nvd.nist.gov/vuln/detail/CVE-2026-108907 https://nvd.nist.gov/vuln/detail/CVE-2026-108929 https://nvd.nist.gov/vuln/detail/CVE-2026-85097 https://nvd.nist.gov/vuln/detail/CVE-2026-102255 https://thehackernews.com https://www.darkreading.com https://patchstack.com https://www.gov.uk/government/statistics/cyber-security-breaches-survey-2024
HR Platform Bypasses Authentication, AI Tools Ship Default Admin Tokens On 11 October 2026, three critical vulnerabilities were published to the National Vulnerability Database, exposing fundamental authentication failures in HR and AI platforms used by UK small businesses. CVE-2026-108707 (CVSS 9.8) allows unauthenticated attackers to access all HR data in Wukong HRM by simply omitting the authentication token header, exposing payslips, salary history, and employee records without any credential check. The vendor was contacted and did not respond. Two further vulnerabilities (CVE-2026-108753, CVSS 9.4, and CVE-2026-108860, CVSS 9.1) affect AI chat platforms Agnaistic and BotSharp, both shipping with hard-coded admin credentials and publicly known JWT signing secrets that allow attackers to forge administrative tokens. For UK businesses, these failures carry direct GDPR obligations: salary and employment data are personal data, and authentication bypass vulnerabilities undermine the requirement for appropriate technical measures under UK GDPR. This episode provides specific audit steps for small business owners, including how to check the NVD for vendor disclosures, how to query IT providers about hard-coded credentials, and why vendor responsiveness to security research is a procurement signal worth evaluating before deployment. Chapters Intro Corrine introduces the episode with a question: when did someone last check whether your HR software actually requires a password? Today’s briefing covers an HR platform that doesn’t enforce authentication at all. The HR System That Skips the Password Check Entirely CVE-2026-108707 (CVSS 9.8) allows unauthenticated attackers to access all HR API endpoints in Wukong HRM by omitting the authentication token header entirely. The platform exposes payslips, salary history, and employee personal data without credential checks. The vendor was contacted and did not respond. UK GDPR obligations for salary and employment data apply, and ICO enforcement history shows significant fines for failure to implement appropriate security measures. CTA Corrine asks listeners to follow the show, leave a rating or review, and share the episode with other small business owners who would benefit from the briefing. The AI Platforms That Hand Out Admin Tokens CVE-2026-108753 (CVSS 9.4) affects Agnaistic through version 1.0.555, with a fixed admin password and public JWT secret in Docker Compose configuration. CVE-2026-108860 (CVSS 9.1) affects BotSharp through version 5.2.0, with HMAC secrets and JWT signing values committed in application settings files. Both allow unauthenticated attackers to forge admin tokens and impersonate users. AI platforms are being adopted rapidly by small businesses, often without audit of default credentials or hard-coded secrets. Why Vendors Who Don’t Respond Are a Specific Problem CVE-2026-108707 and CVE-2026-108576 (CVSS 10.0) both note that vendors were contacted early and did not respond. Vendor responsiveness to security research is a procurement signal: it demonstrates whether they prioritise security and whether they will patch vulnerabilities when disclosed. For UK small businesses, this is a question worth asking before software is deployed. The Broader Pattern: Hard-Coded Credentials Hard-coded credentials are a well-documented, entirely preventable vulnerability class covered by OWASP Top Ten and NCSC guidance. They persist because they are convenient during development and because vendors do not face direct consequences. For UK businesses, running software with known authentication bypass vulnerabilities undermines the requirement for appropriate technical measures under UK GDPR. Cyber Essentials certification requires patching high-severity vulnerabilities within fourteen days, and auditing vendor disclosures is both a certification requirement and a competitive differentiator. Outro Corrine provides specific next steps: produce a list of all applications running in your business, search each in the National Vulnerability Database, and escalate any critical or high-severity results from the last ninety days. For self-hosted platforms, ask IT contacts whether default passwords have been changed and whether hard-coded credentials or JWT secrets have been identified. For HR platforms, contact the vendor and ask for their response to authentication bypass vulnerabilities in their API layer. Links https://nvd.nist.gov/vuln/detail/CVE-2026-108707 https://nvd.nist.gov/vuln/detail/CVE-2026-108753 https://nvd.nist.gov/vuln/detail/CVE-2026-108860 https://nvd.nist.gov/vuln/detail/CVE-2026-108576 https://www.ncsc.gov.uk/collection/developers-collection https://owasp.org/www-project-top-ten/ https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/security/ https://www.ncsc.gov.uk/cyberessentials/overview
AI Vulnerabilities and IoT Threats Exposed In today’s episode of The Daily CVE Update, Corrine Jefferson delves into pressing cybersecurity threats affecting UK small businesses. We explore the MCP protocol vulnerability in AI systems, highlighting its appeal to malicious actors as noted by Ars Technica. Furthermore, the episode uncovers the threat posed by ClingSTUN malware targeting IoT devices, and the critical vulnerabilities found in Microsoft Exchange servers, as reported by The Hacker News. This episode offers practical recommendations to fortify security, emphasising the importance of understanding these risks. By taking preventative measures and securing board-level support, businesses can protect sensitive data and maintain competitive advantage. Chapters Intro Introduction to the episode and the significance of addressing cybersecurity threats for UK businesses. MCP Protocol: A Hidden Threat Discussion on the MCP protocol vulnerability in AI systems and its potential impact on small businesses. CTA Encouragement to follow the show and share it with others. Exploitation of IoT Devices Examination of how ClingSTUN malware exploits IoT devices, exposing businesses to threats. Microsoft Exchange Vulnerability Analysis of vulnerabilities in Microsoft Exchange servers and the importance of applying patches. How to Turn This Knowledge Into Power Strategies to leverage knowledge of vulnerabilities for competitive advantage and security improvement. Securing Board-Level Support Advice on presenting cybersecurity risks to the board, emphasising cost savings and compliance. Actionable Recommendations Practical steps for auditing AI, securing IoT devices, educating staff, and updating systems. Outro Conclusion and motivation to use insights to strengthen business resilience. Links https://arstechnica.com https://www.darkreading.com https://thehackernews.com
Critical CVE Briefing: Citrix NetScaler & Ahsay CBS Threats In today’s episode of The Daily CVE Update, Corrine Jefferson dives into two critical vulnerabilities affecting small businesses in the UK. Focusing on the Citrix NetScaler Denial of Service threat (CVE-2026-88779) and the Ahsay CBS Remote Command Injection issue (CVE-2026-105134), Corrine outlines the severe implications these can have on digital operations. Businesses relying on Citrix NetScaler ADC and Gateway face potential operational halts, with active exploits reported and mitigation plans issued by Citrix. The Ahsay CBS flaw allows remote attackers to execute commands within vulnerable systems, presenting a critical risk. Corrine urges immediate patching and strategic action to protect operations. The discussion extends to leveraging security measures as business advantages, enhancing market trust, and the importance of board-level awareness. Corrine offers actionable steps, including regular security audits, enhanced monitoring, staff training, and vendor accountability. Stay informed to maintain trust and stay competitive. Chapters Intro Corrine introduces the episode’s focus on critical vulnerabilities in Citrix NetScaler and Ahsay CBS. Citrix NetScaler: Denial of Service Threat Examines the Citrix NetScaler vulnerability and its potential impact on business operations if not addressed. CTA Encouragement for listeners to follow, rate, and share the podcast. Ahsay CBS: Remote Command Injection Discussion on the critical vulnerability in Ahsay CBS enabling remote command execution. Competitive Advantage: Navigating the Threat Landscape Explores how proactive security measures can differentiate businesses in the market. Securing Efforts at the Board Level Guidance on discussing cybersecurity threats and mitigations at the board level. Actionable Steps for Your Business Outlines immediate actions businesses should take to combat vulnerabilities. Outro Concludes with a call to action for ongoing vigilance and tuning in for future updates. Links https://www.citrix.com https://www.cisa.gov https://www.ahsay.com
Safeguard Your Business from Critical Cyber Threats In this episode of The Daily CVE Update, Corrine Jefferson guides UK small businesses through the latest cybersecurity threats that could significantly impact operations. We explore vulnerabilities like the Fortinet FortiMail flaw (CVE-2026-104286), which allows attackers to write arbitrary files via crafted HTTP requests. The urgency of applying CISA’s recommended mitigations is highlighted to protect critical business communications and data. We also discuss the Mooncake Transfer Engine exploit (CVE-2026-103764), a gateway for cybercriminals to access your system, and the zero-day vulnerability in Cisco’s SD-WAN Manager (CVE-2026-76504) that could lead to unauthorized admin API access. Crucial actionable steps are provided, including immediate patching, engaging security partners, and educating your team. Corrine emphasises the importance of transparent communication with stakeholders to maintain trust and safeguard future investments. Tune in to gain insights into protecting your business and building a competitive edge through proactive cybersecurity measures. Chapters Intro Corrine introduces the episode and its focus on critical cybersecurity threats. Fortinet FortiMail Vulnerability Discussion on the Fortinet FortiMail flaw and necessary actions to mitigate the risk. CTA Encouragement to follow the podcast and share important information. Mooncake Transfer Engine Exploits Exploration of vulnerabilities in the Mooncake Transfer Engine and their implications. Cisco SD-WAN Zero-Day Insight into the serious threats posed by the Cisco SD-WAN zero-day exploit. Competitive Edge How proactive cybersecurity measures enhance business reputation and trust. Board-Level Discussions Strategies for effective communication of cybersecurity importance at the board level. Actionable Steps Detailed steps for businesses to secure their operations against cyber threats. Outro Conclusion and reminder to stay informed for cybersecurity defence. Links https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-104286 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-103764 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76504 https://www.cisa.gov/news-events/directives/bod-26-04
Understanding Cisco and Zimbra Vulnerabilities In this episode of The Daily CVE Update, Corrine Jefferson discusses critical vulnerabilities affecting UK’s small businesses. We explore the serious implications of the Cisco Catalyst SD-WAN flaw, identified as CVE-2026-76504. This vulnerability grants attackers admin-level access, potentially disrupting entire operations if unpatched. Zimbra Collaboration Suite also faces severe threats with CVE-2026-73570, allowing attackers to deploy web shells and access email credentials. Corrine underlines the importance of immediate updates and highlights how these security breaches can serve as a competitive advantage when addressed effectively. She argues that with proper strategic positioning and vigilant security measures, businesses can assure clients of their robustness. Concluding with board-level motivations and actionable recommendations, Corrine stresses the necessity of strong digital defences in maintaining business integrity. Chapters Intro Overview of vulnerabilities in Cisco and Zimbra impacting UK businesses. Cisco Catalyst SD-WAN Vulnerability In-depth analysis of the CVE-2026-76504 vulnerability and its potential impact. Zimbra Email Server Exploitation Exploration of CVE-2026-73570 and its risks to email security. Competitive Advantage Section How addressing vulnerabilities can set businesses apart. Board-Level Selling Points The importance of security discussions at the board level. Actionable Recommendations Steps to mitigate risks and improve security measures. Outro Final thoughts on maintaining proactive cybersecurity strategies. Links https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-76504 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-73570 https://www.cisco.com/c/en/us/products/security/sd-wan/index.html https://www.zimbra.com/
Navigating Today’s Critical CVE Threats In this episode of The Daily CVE Update, Corrine Jefferson explores critical vulnerabilities affecting key technology platforms for small businesses in the UK. The episode dives into a zero-day flaw in Apple’s CoreGraphics that risks data exposure on iOS, macOS, and iPadOS devices. Corrine discusses the implications for business security and the importance of urgent patching. Next, the focus shifts to Dockhand’s severe authentication bypass vulnerability, posing risks of system compromise and data breaches. Finally, the episode highlights an RPyC issue in LightLLM, exposing systems to potential remote control by attackers. Corrine stresses proactive measures like disabling profiling and conducting vulnerability assessments. Learn how to transform these security challenges into a competitive advantage in the market and bolster business resilience. Chapters Intro Corrine introduces the episode, emphasising the importance of staying informed about cybersecurity threats for small businesses. The Apple CoreGraphics Zero-Day Discussion on the CVE-2026-86950 vulnerability affecting Apple devices, its risks, and the necessity of immediate patching. CTA Reminder to follow the podcast and share it with others who might find it valuable. Critical Dockhand Authentication Bypass Examination of CVE-2026-53988 and its impact on Dockhand users, with preventive actions outlined. The RPyC Disaster with LightLLM Analysis of CVE-2026-103040 in LightLLM and measures to mitigate remote code execution risks. How to Turn This Into a Competitive Advantage Advice on using security competency as a competitive edge in the market. Making the Business Case Guidance on communicating the importance of security investments to the board. What This Means for Your Business Summary of critical actions for securing business operations and fostering a security-conscious culture. Links https://www.darkreading.com https://cisa.gov https://www.nist.gov
Netcore Vulnerabilities: A Wake-Up Call for UK Small Businesses In today’s episode of The Daily CVE Update, host Corrine Jefferson uncovers critical vulnerabilities in Netcore devices that pose significant threats to UK small businesses. With vulnerabilities such as CVE-2026-101000, CVE-2026-101072, and CVE-2026-101076 reaching a CVSS score of ten, businesses face the serious risk of remote attackers bypassing authentication and gaining unauthorised access to their networks. Corrine highlights the ongoing negligence of vendors like Netcore, leaving companies to fend for themselves against potential cyber threats. Despite the challenges, she encourages businesses to use this situation as a catalyst for improving security practices. By investing in advanced security measures, companies can build resilience and gain a competitive edge. Corrine walks listeners through actionable steps, from auditing devices to educating teams and pressuring vendors for timely updates. As the episode concludes, the focus remains on proactive security and the importance of turning challenges into opportunities for growth. Chapters Intro Introduction to the episode’s focus on security vulnerabilities in Netcore devices. A Wake-Up Call for UK Small Businesses Discussion on how Netcore’s flaws impact UK businesses and how it’s a recurring issue. Recent Vulnerabilities Expose the Weak Underbelly Deep dive into specific vulnerabilities affecting Netcore devices and their implications. Vendors Silent, The Real Impact Examination of Netcore’s lack of response and its effect on small businesses. Turning the Challenge into an Opportunity Encouragement to improve security posture and use it to gain a business advantage. Pitching the Reality to Your Board Strategies to convince board members to invest in better security measures. Specific Actionable Steps Practical steps to protect businesses from current vulnerabilities. CTA Encouragement to engage with the podcast through reviews and sharing. Outro Final thoughts on the importance of proactive security measures.
Urgent Citrix Vulnerabilities: Immediate Actions Required Join Corrine Jefferson on The Daily CVE Update as she unpacks the latest Citrix zero-day vulnerabilities threatening UK small businesses. Discover the critical nature of these security flaws affecting Citrix NetScaler ADC and NetScaler Gateway, known for enabling remote code execution. With active exploitation underway, it’s a pressing concern that can’t be ignored. Corrine discusses the impact on business operations, offers actionable recommendations, and explains how strengthening your cybersecurity posture could provide a competitive edge. Tune in for essential insights into managing these pressing risks effectively. Chapters Intro Corrine introduces the episode, highlighting the critical nature of Citrix vulnerabilities affecting UK small businesses. Citrix Zero-Days: Act Now or Face the Consequences Details on two severe zero-day vulnerabilities in Citrix products, allowing remote code execution, and the immediate threat they pose. CTA Corrine encourages listeners to follow and share the show for continued insights. Understanding the Threat Landscape Explanation of the specific vulnerabilities, CVE-2026-88772 and CVE-2026-88771, and their potential exploitation. The Impact on UK SMBs Discussion on the significant risks these vulnerabilities pose to UK small businesses and their operations. Competitive Advantage: Strengthening Your Cyber Posture Explore how robust cybersecurity measures can enhance business credibility and provide a competitive edge. Communication to Boards: The Business Case Strategies for effectively communicating cybersecurity risks and compliance requirements to business boards. Actionable Recommendations for Businesses Practical steps for businesses to address and mitigate the risks associated with Citrix vulnerabilities. Outro Closing remarks from Corrine, urging immediate action and continued vigilance in cybersecurity. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://thehackernews.com
Critical CVEs: WSO2, Adobe, and HFS2 Under Siege In today’s episode of The Daily CVE Update, hosted by Corrine, we delve into critical vulnerabilities affecting small businesses in the UK. The spotlight is on serious security flaws in WSO2, Adobe’s Commerce and Magento, and HFS2. These vulnerabilities pose existential threats—ranging from path traversal to incorrect authorisation and template injection—that demand immediate attention. Failure to address these could lead to remote code execution, data breaches, and severe reputational damage. We discuss the importance of timely patching to safeguard sensitive data and maintain client trust. The episode also covers strategic advice on communicating these risks to your board and actionable steps to secure your operations. Tune in to stay one step ahead in cybersecurity. Chapters Intro Introduction to today’s episode, focusing on critical vulnerabilities in WSO2 and Adobe products that threaten small businesses. The WSO2 Vulnerability: CVE-2026-5430 Discussion on WSO2’s path traversal vulnerability, which allows remote code execution. Urgent patching is advised to prevent significant business risks. CTA Reminder to follow, rate, and share the podcast for valuable cybersecurity insights. Adobe’s Commerce and Magento in the Crosshairs: CVE-2026-71362 Details on Adobe’s incorrect authorisation issue, risking sensitive data exposure. Quick action is necessary to protect customer information. HFS2’s Critical Fault: CVE-2026-97359 Exploration of HFS2’s maximum severity template injection flaw, requiring immediate patching to prevent active exploitation. Giving Your Business an Edge Addressing vulnerabilities can enhance your competitive edge and build client trust by demonstrating a strong security posture. Make Your Case to the Board Guidance on presenting cybersecurity initiatives to your board, emphasising risk mitigation and long-term reputational benefits. Immediate Actions Essential steps for today: patch systems, secure internet connections, and bolster monitoring to deter potential attacks. Outro Closing remarks on maintaining robust defences and staying informed on security threats. Links https://cisa.gov https://adobe.com https://wso2.com
Check Point and WordPress Zero-Days Under Active Exploitation On 22 September 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalogue, confirming active exploitation in the wild. Two affect Check Point firewall management infrastructure (CVE-2026-93616 and CVE-2026-85102), allowing unauthenticated remote code execution. The third, CVE-2026-87902, is a critical path traversal flaw in WordPress core affecting approximately 43% of all websites globally. For UK small businesses, the primary risk lies not in direct exploitation but in unverified patching by managed service providers, web developers, and hosting agencies. This episode provides specific guidance on verifying patch status with third-party providers, checking WordPress version numbers, and establishing documented response processes for CISA KEV additions. The common thread across all three disclosures is infrastructure typically assumed to be someone else’s responsibility to maintain, creating a verification gap that attackers are actively exploiting. Businesses are advised to contact their MSPs immediately with specific CVE numbers, audit their technology supply chain for patching accountability, and review cyber insurance terms regarding timely vulnerability remediation. Chapters Introduction Corrine opens by asking when listeners last verified specific CVE patches with their MSP. CISA has confirmed active exploitation of vulnerabilities in Check Point firewall management systems and WordPress core, both with patches available and documented exploitation in the wild. Check Point Management Server Zero-Day CVE-2026-93616 and CVE-2026-85102 were added to CISA’s KEV catalogue on 22 September 2026. Both affect Check Point infrastructure and allow unauthenticated remote code execution. UK small businesses typically rely on MSPs to patch these systems, creating a verification gap. Corrine provides specific questions to ask providers and explains why vague responses indicate service quality issues. Call to Action Listeners are encouraged to follow the show, leave ratings and reviews, and share the episode with other small business operators who may believe today’s threats do not apply to them. WordPress Core Critical Flaw CVE-2026-87902 is a path traversal vulnerability in WordPress core itself, not a plugin or theme. It affects approximately 43% of all websites and allows unauthenticated remote code execution on certain server configurations. Many UK small business websites run on loose maintenance arrangements with no recent admin access. Corrine explains how to check version numbers and why core vulnerabilities have categorically different urgency than plugin flaws. The Pattern Behind This Week’s Disclosures CISA also added CVE-2026-93952 affecting Arista VeloCloud SD-WAN infrastructure on the same day. All three confirmed exploitation campaigns target infrastructure businesses typically assume is someone else’s responsibility to maintain. This verification gap is where attackers are operating. The NCSC considers supply chain security a board-level concern, and trust is not a substitute for verification. Closing Remarks Corrine summarises practical takeaways: contact MSPs with specific CVE numbers, check WordPress version numbers immediately, and audit technology infrastructure for patching accountability. Listeners are reminded to review cyber insurance terms regarding timely vulnerability remediation, as many policies define windows for patching known critical vulnerabilities. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.checkpoint.com/ https://wordpress.org/ https://www.ncsc.gov.uk/collection/10-steps/risk-management https://www.ncsc.gov.uk/collection/supply-chain-security
Urgent Cybersecurity Alerts for UK Businesses In today’s episode of The Daily CVE Update, hosted by Corrine, we delve into two critical cybersecurity vulnerabilities that demand immediate attention from UK small businesses. The first, CVE-2026-7273, affects Zyxel GS1900 switches and poses a significant risk due to a stack-based buffer overflow. Unauthenticated attackers could exploit this to execute OS commands, potentially compromising entire network systems. Zyxel and CISA have provided mitigation guidelines that businesses should follow without delay. The second vulnerability, CVE-2026-94493, has a severe CVSS score of ten and affects Gigatech PDV5701 devices. With no vendor response or fix available, businesses are advised to halt use of these devices until the issue is resolved. The episode highlights the need for proactively managing cybersecurity risks, stressing the importance of aligning with CISA directives and engaging vendors for better accountability. By taking these steps, businesses can not only mitigate threats but also differentiate themselves in a competitive market by demonstrating their commitment to cybersecurity. Chapters Intro Introduction to the episode’s focus on urgent cybersecurity issues for UK small businesses. Critical Vulnerabilities at Large Discussion on CVE-2026-7273 affecting Zyxel switches and CVE-2026-94493 affecting Gigatech devices. CTA Encouragement to follow the show and engage with the content. Defensive Posture and Strategies Advice on preparing and defending against the discussed vulnerabilities with specific strategies. Turning Threats into Opportunities Using proactive cybersecurity measures as a business advantage and differentiator. Making the Business Case Highlighting the importance of investing in cybersecurity and engaging vendors for transparent practices. What This Means for Your Business Actionable steps for businesses, including audits and incident preparedness. Outro Conclusion, reiterating the importance of proactive cybersecurity measures. Links https://cve.org/CVERecord?id=CVE-2026-7273 https://cve.org/CVERecord?id=CVE-2026-94493 https://www.zyxel.com/us/en https://www.gigatech.com https://www.cisa.gov
Five Perfect-Score Router Flaws and the Offboarding Risk You’re Ignoring Five CVSS 10.0 vulnerabilities have been published against networking equipment commonly found in UK small business offices, with public exploits requiring no authentication. Corrine examines the command injection and buffer overflow flaws affecting Netcore NBR200V2 and D-Link DIR-868L routers, explaining how attackers can achieve full network control through diagnostic endpoints, traceroute functions, and even login pages. The episode also dissects the CrowdSec breach, where 170 private GitHub repositories were copied using a former employee’s unrevoked credentials, and explores why offboarding failures remain a persistent regulatory concern for small businesses. Practical guidance includes identifying boundary devices, applying patches, restricting management interfaces, auditing former employee access across all systems, and holding managed service providers accountable for patch status and access revocation. The episode positions router security and offboarding processes as immediate compliance requirements under Cyber Essentials, not theoretical risks. Chapters Intro Corrine introduces today’s threat picture: five CVSS 10.0 vulnerabilities against networking equipment used in UK small businesses, with public exploits requiring no authentication. Five CVSS 10.0 Router Flaws: The Netcore and D-Link Crisis Detailed examination of five maximum-severity vulnerabilities affecting Netcore NBR200V2 and D-Link DIR-868L routers, including command injection through diagnostic endpoints, traceroute functions, LAN configuration handlers, backup systems, and a buffer overflow in the DIR-868L authentication handler. All exploits are public and unauthenticated. Vendor non-response is noted. CTA Request for listener engagement: follow the show, leave reviews, and share with other business owners. CrowdSec Breach: The Offboarding Failure Nobody Talks About Analysis of the CrowdSec breach where 170 private GitHub repositories were copied using a former employee’s unrevoked credentials found in a compromised npm package. The incident illustrates systemic offboarding failures common in small businesses and frequently seen in ICO breach records. What to Do This Week Five specific actions: identify boundary devices and firmware versions, check for and apply patches, restrict management interface access, audit former employee access across all systems, and request written confirmation from managed service providers on patch status and access revocation. Cyber Essentials compliance implications are noted. Outro Summary of the episode’s core message: routers are active targets requiring immediate attention, and unrevoked credentials are open doors. Both issues are fixable this week through systematic action. Links https://nvd.nist.gov/vuln/detail/CVE-2026-94097 https://nvd.nist.gov/vuln/detail/CVE-2026-94095 https://nvd.nist.gov/vuln/detail/CVE-2026-94096 https://nvd.nist.gov/vuln/detail/CVE-2026-94099 https://nvd.nist.gov/vuln/detail/CVE-2026-94100 https://nvd.nist.gov/vuln/detail/CVE-2026-94089
Two CVSS 10.0 Vulnerabilities Demand Immediate Action Two maximum-severity vulnerabilities have emerged within hours of each other, both scoring CVSS 10.0. CVE-2026-76460, an authentication bypass flaw in Cisco Identity Services Engine, is confirmed by CISA as actively exploited in the wild. The vulnerability allows attackers to bypass network access controls entirely, with no credentials required. A second Cisco flaw, CVE-2026-76461 affecting Secure Email Gateway, has also entered CISA’s known exploited vulnerabilities catalogue. Simultaneously, Microsoft disclosed seven CVSS 10.0 vulnerabilities across Azure infrastructure, including Azure Arc, Logic Apps, AI Foundry, Billing, Fabric, and Container Registry. Whilst active exploitation of the Azure flaws remains unconfirmed, the severity ratings reflect maximum impact and exploitability without authentication. UK small businesses face exposure through three vectors: managed service provider dependencies, supply chain relationships, and cloud infrastructure reliance. The episode provides five specific actions to complete before week’s end, including contacting MSPs for written confirmation of patch status, checking Microsoft 365 service health dashboards, and documenting all due diligence steps for ICO accountability and cyber insurance purposes. Chapters Intro Two CVSS 10.0 vulnerabilities disclosed within hours. One actively exploited, confirmed by US government. Both affect infrastructure UK small businesses depend on daily. Cisco’s Zero-Day Under Active Attack CVE-2026-76460 authentication bypass in Cisco Identity Services Engine confirmed as actively exploited by CISA. Allows attackers to bypass network access controls without credentials. CVE-2026-76461 in Cisco Secure Email Gateway also enters KEV catalogue. Patches available for both. CTA Request to follow, rate, review, and share the podcast. Microsoft Azure’s Very Bad Night Seven CVSS 10.0 vulnerabilities disclosed across Azure infrastructure: Arc, Logic Apps, AI Foundry, Billing, Fabric, and Container Registry. Flaws include privilege escalation, missing authentication, path traversal, and authorisation bypass. Active exploitation unconfirmed but conditions present. Why This Affects You Even Without Enterprise Kit Three exposure vectors for small businesses: MSP infrastructure dependencies, supply chain relationships, and cloud platform reliance. Cisco ISE compromises at providers create footholds into client environments. Azure vulnerabilities affect any business using Microsoft 365 or Azure-hosted services. Knowing This Gives You an Edge Due diligence documentation matters for ICO accountability and cyber insurance claims. Demonstrating active vulnerability tracking supports Cyber Essentials certification and separates genuine security posture from checkbox compliance. What to Do Before the End of the Week Five specific actions: contact MSP about Cisco patch status, check Microsoft 365 service health dashboard, review supplier Azure dependencies, verify email security configuration, and document all responses in writing. Outro Two CVSS 10.0 vulnerabilities, one confirmed as actively exploited. Practical response requires contacting MSPs, checking service health dashboards, and documenting every step for accountability. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Acronis Backup, Cisco ISE, and Pixel Flaws Under Active Exploit Three vulnerabilities have landed on CISA’s Known Exploited Vulnerabilities catalogue overnight, and two of them sit in systems most small businesses never think about but rely on entirely. CVE-2026-87886 affects Acronis Backup software widely deployed in managed hosting environments. CVE-2026-76460 is a perfect-10 authentication bypass in Cisco’s Identity Services Engine, the network access control system that decides who gets onto your network. CVE-2026-58704 targets Google Pixel devices. All three are confirmed under active exploitation. This episode walks through what each vulnerability means in practical terms, why backup and network access control are central to ransomware defence, and what questions to put to your MSP today. We also cover Cisco’s wider release of more than twenty critical CVEs published in a single day, including multiple routes to full system compromise in firewall and network management infrastructure. For UK small businesses, the direct technical exposure may be limited, but the supply chain risk through managed service providers is not. This is about accountability, not alarm. If your MSP manages these systems on your behalf and hasn’t called you yet, this episode explains what to ask and why the answer matters. Chapters Intro Corrine opens with a question: when did your MSP last call you about a specific, confirmed active exploit in software they manage on your behalf? Three vulnerabilities landed on CISA’s KEV catalogue overnight, affecting backup software, network access control, and mobile devices. Cisco published more than twenty critical CVEs in a single day. The focus is on systems managed by third parties, where patching depends on your MSP, not you. Acronis Backup Actively Exploited CVE-2026-87886 is a privilege escalation vulnerability in the Acronis Backup plugin for cPanel and Plesk. Backup software is trusted, has access to everything, and is almost never monitored by the client. Modern ransomware groups target backups first. CISA’s KEV listing confirms active exploitation. Corrine provides three specific questions to put to your MSP: patch status, written confirmation, and when backups were last tested. If you can’t get a clear answer within 48 hours, that’s a contractual concern. CTA Corrine invites listeners to follow the show, leave a rating or review, and share the episode with business owners who should be asking these questions. Cisco: A Perfect Ten CVE-2026-76460 is a CVSS 10.0 authentication bypass in Cisco Identity Services Engine. ISE is network access control infrastructure that decides who and what is allowed onto a network. An unauthenticated remote attacker can bypass the management interface and gain full access. Most small businesses don’t run ISE directly, but their MSPs do. A compromise of the MSP’s ISE deployment is a risk to every client on that estate. Cisco’s Wider Vulnerability Dump Cisco published more than twenty critical and near-critical CVEs on 16 September across ISE, Nexus Dashboard, Secure Firewall Management Center, and Adaptive Security Appliance products. Multiple vulnerabilities allow unauthenticated remote attackers to gain administrative access, execute arbitrary commands as root, and fully compromise systems. These are central infrastructure systems that large MSPs and managed security providers run on behalf of dozens or hundreds of clients. Direct exposure is limited for small businesses, but supply chain risk through MSPs is not. Google Pixel Vulnerability CVE-2026-58704 affects Google Pixel devices: an improper authorisation vulnerability in the cellular modem component allows privilege escalation. If staff use Pixel phones for work email, cloud applications, or any business data access, this needs attention today. The fix is a software update via Settings, Security and emergency, Security update. Apply it immediately. If you have a bring-your-own-device policy, communicate this to staff directly. Browser Extensions and AI Assistants Researchers published proof-of-concept work showing that a single malicious browser extension can hijack AI assistants across Chrome, Edge, and related browsers by manipulating the context the AI receives. If staff use AI assistants in the browser for business work, review which browser extensions are installed and remove any that are not explicitly authorised and necessary. What This Means for Your Business Corrine provides concrete steps: contact your MSP today about CVE-2026-87886 and CVE-2026-76460, request written confirmation of patch status, check Pixel devices for updates, test your backup by actually restoring a file, and audit browser extensions on machines using AI tools. Proactive vulnerability communication from your MSP is a baseline expectation. If you don’t receive it, the absence is evidence. Use it accordingly. Outro The CISA Known Exploited Vulnerabilities catalogue is the most reliable public signal that a vulnerability is being actively weaponised. When something lands on that list, the time for patching is now. Your backup and network access control determine whether you survive a serious attack. Make sure whoever is responsible for them knows what they’re doing. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://sec.cloudapps.cisco.com/security/center/publicationListing.x
The Patch Gap: WooCommerce, Lateral Movement, and Email Gateway Exploits Three active exploitation campaigns landed on 16 September 2026, and every single one targeted vulnerabilities with available patches. Corrine walks through the WooCommerce Wholesale Lead Capture plugin flaw (CVE-2026-27540) enabling unauthenticated file uploads, the eight-second lateral movement documented in a Marimo notebook exploit (CVE-2026-39987), and the SQL injection vulnerability in Cisco Secure Email Gateway (CVE-2026-76461) now confirmed under active attack. This episode focuses on the operational gap between patch availability and patch application, which has become the primary risk vector for UK small businesses. No sophisticated tooling required, no zero-days involved, just known flaws in e-commerce platforms, development environments, and email security appliances being exploited at scale. Corrine provides specific, actionable steps for WooCommerce operators, questions to ask MSPs about network segmentation, and concrete guidance for businesses using managed email security services. The thread connecting all three stories is documented proof that the time window between initial compromise and lateral movement has collapsed to seconds, not hours, making pre-incident preparation and patch discipline the only reliable defensive posture. Chapters Intro Corrine introduces three unconnected exploitation stories from 16 September 2026 that share one common thread: all had patches available before attackers began active campaigns. The gap between patch availability and patch application is now the primary risk for UK small businesses. WooCommerce Wholesale Lead Capture: Active Exploitation CVE-2026-27540 enables unauthenticated file upload and remote code execution in the WooCommerce Wholesale Lead Capture plugin. Wordfence confirms months-long exploitation campaigns. Over six thousand shops use the plugin, with uncertain numbers still running vulnerable versions below 2.0.3.2. Corrine explains web shell mechanics, UK GDPR obligations, and provides step-by-step update instructions. CTA Listener call to action: follow, rate, review, and share the episode. Eight Seconds: What Lateral Movement Now Looks Like Sysdig research documents a human attacker exploiting CVE-2026-39987 in Marimo Python notebooks, achieving lateral movement to an SSH bastion host in eight seconds. Corrine examines the collapse of traditional incident response timelines and the importance of network segmentation for small businesses. Cisco Secure Email Gateway: SQL Injection Under Active Attack Cisco confirms active exploitation of CVE-2026-76461, a critical SQL injection flaw granting unauthenticated root access to Cisco Secure Email Gateway appliances. Corrine details the intelligence exposure risk and provides questions for businesses using managed email security providers. Why the Pattern Matters All three vulnerabilities involved available patches, common business software, and active exploitation. Corrine discusses the competitive advantage of documented patch management, the insurance framing for decision-makers, and the operational intelligence risk of email gateway compromise. Outro Five specific actions before Friday: check WooCommerce plugin versions, ask MSPs about network segmentation, confirm Cisco patch status, review all WordPress plugins, and document what was checked and when. Corrine emphasises that the defence is not complicated, just consistent application of available fixes. Links https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wwlc-woocommerce-wholesale-lead-capture/woocommerce-wholesale-lead-capture-2031-unauthenticated-arbitrary-file-upload https://sysdig.com/blog/marimo-notebook-vulnerability-cve-2026-39987/ https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-esa-sql-injection-76461 https://thecyberexpress.com/four-in-five-business-websites-vulnerable/
Cisco Email Gateway Exploited, D-Link Routers at CVSS 9.9 On 14 September 2026, CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalogue, confirming active exploitation of a critical SQL injection flaw in Cisco Secure Email Gateway. The vulnerability allows unauthenticated remote attackers to execute arbitrary commands with root privileges. Dark Reading reported that Russian threat actor Sandworm is chaining Cisco vulnerabilities to deploy Cyclops Blink malware, a sophisticated implant that harvests credentials and maintains persistent access. The same day, D-Link disclosed critical buffer overflow and command injection vulnerabilities in three router models (DIR-823G, DIR-878, DWR-M921), scoring up to 9.9 on CVSS, with public exploit code already available. Most UK small businesses do not operate their own email filtering infrastructure but rely on managed service providers whose patch status directly affects their risk exposure. Similarly, consumer-grade routers are frequently deployed and forgotten, with no active firmware management process. This episode provides specific mitigation steps: confirming patch status with MSPs, auditing router inventory, restricting management interfaces to local networks, and establishing defined response times for CISA KEV items in service agreements. Chapters Introduction Corrine introduces episode 50, marking The Daily CVE Update’s milestone since June 2026. Two critical stories require immediate attention: email infrastructure affecting UK supply chains and consumer routers with confirmed exploitation activity and public exploit code. Cisco Secure Email Gateway Actively Exploited CISA added CVE-2026-76461 to its Known Exploited Vulnerabilities catalogue on 14 September 2026. The SQL injection flaw in Cisco AsyncOS allows unauthenticated remote attackers to execute commands with root privileges on Secure Email Gateway appliances. Sandworm is chaining Cisco vulnerabilities to deploy Cyclops Blink malware. Two additional critical CVEs (2026-20353, 2026-76441) were published the same day. Small businesses face supply chain exposure through managed service providers running vulnerable infrastructure. Call to Action Corrine encourages listeners to follow the show, leave ratings and reviews, and share the episode with colleagues who need to hear about the Cisco situation before the weekend. D-Link Routers With CVSS 9.9 Flaws and Public Exploits D-Link disclosed critical vulnerabilities on 14 September 2026 affecting DIR-823G, DIR-878, and DWR-M921 routers. CVEs 2026-90680, 2026-90692, and 2026-90693 are remotely exploitable buffer overflows scoring 9.9. CVEs 2026-90702 and 2026-90703 are command injection flaws with publicly available exploit code. These routers are common in UK small business environments and frequently unmanaged after initial deployment. Why This Matters If You Think You’re Too Small The Cisco situation is a supply chain risk affecting organisations that do not directly operate vulnerable infrastructure. The D-Link situation demonstrates consequences of unmanaged network hardware. Organisations with defined processes for monitoring CISA KEV and rapid patching have measurable, auditable security postures that differentiate them from peers. Outro and Action Items Five specific actions before Friday: confirm email filtering patch status with written confirmation from MSPs, audit router inventory for affected D-Link models, verify management interfaces are not internet-facing, subscribe to CISA KEV feed, and establish written patch SLAs for actively exploited vulnerabilities in service agreements. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.darkreading.com/ https://nvd.nist.gov/ https://www.ncsc.gov.uk/ https://www.cisa.gov/ https://www.dlink.com/
Router and Remote Access Vulnerabilities: Immediate Actions for UK SMBs This episode examines ten newly disclosed and actively exploited vulnerabilities affecting router and remote access infrastructure commonly deployed in UK small business networks. Host Corrine Jefferson walks through six CVEs added to CISA’s Known Exploited Vulnerabilities catalogue between 10 and 11 September 2026, including critical flaws in ConnectWise ScreenConnect and MikroTik RouterOS, plus four new critical-severity Totolink router vulnerabilities published to the NIST National Vulnerability Database. The episode explains supply chain risk through managed service provider remote access tools, the specific threat posed by compromised network perimeter devices, and provides five actionable steps businesses can take before week’s end. Corrine offers practical guidance on holding IT providers accountable, understanding buffer overflow exploits, and building a documented patch verification process. The briefing is aimed at business owners and decision-makers who need to understand why infrastructure vulnerabilities demand immediate attention, particularly when public exploit code is already circulating. Chapters Introduction Corrine introduces the episode’s focus on confirmed exploits targeting routers and remote access infrastructure commonly found in UK small business networks. What CISA’s KEV List Actually Means Explanation of the Known Exploited Vulnerabilities catalogue as a verified threat indicator, covering the six CVEs added between 10 and 11 September 2026 and the distinction between theoretical vulnerabilities and confirmed active exploitation. ConnectWise ScreenConnect: The Supply Chain Risk in Your Network Analysis of CVE-2026-86060 in ConnectWise ScreenConnect, the remote access tool widely used by UK managed service providers, and the supply chain implications when MSP infrastructure is compromised. Call to Action Corrine encourages listeners to follow the show, leave reviews, and share the episode with business owners who rely on managed service providers. MikroTik RouterOS: When Your Router Is the Threat Coverage of CVE-2026-85706 and related MikroTik RouterOS vulnerabilities now on the KEV catalogue, explaining why a compromised router poses unique visibility challenges for standard security tooling. Four New Totolink CVEs: A Different Router Problem Breakdown of CVE-2026-90605 through CVE-2026-90608, four critical buffer overflow vulnerabilities affecting the Totolink A3002MU router, with public exploit code already available. What Your MSP Should Be Telling You Guidance on reasonable expectations for managed service provider communication during active exploitation events, and how to frame accountability questions professionally. The Competitive Edge in Paying Attention Discussion of how active threat intelligence monitoring differentiates businesses in procurement scenarios and supports robust security posture beyond baseline compliance. What to Do Before Friday Five specific, actionable steps: identify remote access tools, audit routers, request patch logs, bookmark the KEV catalogue, and document all provider communications. Closing Corrine summarises the episode’s core message and reinforces the urgency of verifying infrastructure patch status before the end of the week. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog
AI-Assisted Exploitation and Active MikroTik Threats This episode examines two critical threats affecting UK small businesses: a Russian-speaking actor’s deployment of AI agents that compromised 440 PaperCut print management servers across 48 countries in 48 hours, and CISA’s addition of two actively exploited MikroTik RouterOS vulnerabilities to its Known Exploited Vulnerabilities catalogue. Corrine explains how industrialised exploitation through AI automation has collapsed the window between vulnerability disclosure and mass compromise, why background infrastructure like print management software and networking hardware attracts attackers precisely because organisations overlook it, and what specific actions businesses must take within 72 hours. The episode provides concrete guidance on asset identification, patch prioritisation, and vendor accountability, with particular focus on CVE-2026-82078, CVE-2026-81578, CVE-2026-86060, and CVE-2026-67277. This is not theoretical risk assessment; this is operational intelligence from confirmed active exploitation in September 2026. Chapters Introduction Corrine introduces two separate threats that share a concerning pattern: the pace of modern exploitation has fundamentally changed, and background infrastructure remains dangerously overlooked. AI Agents Compromise 440 PaperCut Servers in 48 Hours Analysis of a suspected Russian-speaking actor’s deployment of hundreds of AI agents to exploit CVE-2026-82078 and CVE-2026-81578 in PaperCut print management servers, compromising 440 organisations across 48 countries in approximately 48 hours. Includes specific actions for identifying, patching, and confirming remediation. Call to Action Corrine invites listeners to follow the show, leave reviews, and share episodes with small business owners who need this intelligence. MikroTik RouterOS: Two Actively Exploited Vulnerabilities Examination of CISA’s 10 September addition of CVE-2026-86060 and CVE-2026-67277 to the Known Exploited Vulnerabilities catalogue, covering the specific risks to hospitality and small business environments, and providing a five-point checklist for immediate remediation. The Speed of Modern Exploitation Discussion of how AI-assisted exploitation has collapsed the vulnerability-to-exploitation timeline, why monthly patching cycles are no longer defensible for internet-facing infrastructure, and the commercial implications of demonstrable security posture for supply chain relationships. Conclusion Corrine summarises the week’s actionable intelligence and reinforces the 72-hour patching requirement for critical vulnerabilities in network-facing infrastructure.
Urgent CVE Alerts: Citrix and Chrome Vulnerabilities In today’s episode of The Daily CVE Update, Corrine delves into two critical cybersecurity vulnerabilities impacting small businesses. With a focus on the recent authentication bypass flaw in Citrix NetScaler (CVE-2026-19490) and a critical exploit in Google Chrome’s V8 JavaScript engine (CVE-2026-87491), listeners are given essential information on how to safeguard their digital environments. Corrine highlights the necessity of immediate patching, robust network monitoring, and employee education. She also explains how proactive cybersecurity measures can serve as a competitive advantage and bolster trust with clients. Join Corrine as she explores these pressing issues and provides actionable recommendations to enhance digital security. Chapters Intro Corrine introduces the episode’s focus on critical vulnerabilities in Citrix and Google Chrome. Crippling Authentication Vulnerabilities in Citrix A detailed analysis of the authentication bypass vulnerability in Citrix NetScaler and the importance of applying recent patches. CTA Listeners are encouraged to subscribe, rate, and share the podcast. Google Chrome’s Latest Exploit: A Wake-Up Call for All Discussion of the remote code execution threat in Google Chrome’s V8 JavaScript engine and its implications. Competitive Advantage: Secure Your Digital Assets How maintaining up-to-date cybersecurity measures can enhance brand trust and marketability. Board-Level Selling Points Key reasons to prioritise cybersecurity: risk reduction, cost-efficiency, compliance, and reputation. Actionable Recommendations Practical steps for patching, monitoring, employee education, and strengthening access controls. Outro Reiteration of the urgency in addressing today’s highlighted vulnerabilities. Links https://www.citrix.com/blog/2026/alerts https://www.google.com/security-cve-2026-v8 https://www.cisa.gov/publication/vulnerabilities-2026
Urgent Security Flaws in Adobe and Microsoft Products In this episode of The Daily CVE Update, host Corrine highlights critical vulnerabilities in Adobe Commerce, Magento, and Microsoft Windows. Small businesses are particularly at risk from CVE-2026-75650, an exploit in Adobe’s systems that allows dangerous code execution, as well as CVE-2026-81963 and CVE-2026-85880 in Microsoft’s software, which facilitate privilege escalation attacks. Corrine stresses the immediate need for applying patches and the significant business risks of inaction. This episode offers actionable advice to turn these security challenges into a competitive edge by enhancing cybersecurity measures and building customer trust. Chapters Intro Introduction to urgent cybersecurity vulnerabilities affecting small businesses. Adobe Commerce and Magento (CVE-2026-75650) Discussion on Adobe vulnerabilities allowing code execution. Urges immediate action. CTA Encouragement to follow, rate, and review the podcast. Microsoft Windows Vulnerabilities Explains critical flaws in Microsoft systems that enable privilege escalation. The Business Impact Explores the broader business consequences of neglecting these vulnerabilities. How to Turn This Into a Competitive Advantage Guide on leveraging proactive security measures for business reputation enhancement. Recommendations for Immediate Action Provides actionable steps to secure systems and improve cybersecurity awareness. Board-Level Talking Points Addresses how to communicate the importance of security measures to the board. Outro Wrap-up with a reminder of the significance of taking proactive security measures. Links https://adobe.com/security-updates https://microsoft.com/security-updates
Critical Vulnerabilities: Protect Your Business Now In this episode of The Daily CVE Update, Corrine Jefferson delivers crucial insights on two significant vulnerabilities threatening UK small businesses: CVE-2026-86296 and CVE-2026-75650. Discover the details of these high-severity risks in the D-Link DIR-822A and Adobe Commerce systems. Corrine explains how such vulnerabilities could lead to severe breaches, causing financial and reputational damage to your business. She also emphasises the importance of rapid action, highlighting real-world consequences and offering strategies to turn these challenges into competitive advantages. Learn how to effectively communicate these risks to your board and take proactive steps to secure your network and protect your clients’ trust. Chapters Intro Corrine introduces critical vulnerabilities threatening business security. The High-Stakes Risks Examines vulnerabilities in D-Link and Adobe, highlighting their severity. Real-World Consequences Discusses the potential financial and reputational impact on businesses. Compounding Threats Warns about increasing exploitation of new vulnerabilities. CTA Encourages listeners to engage and share the podcast. How to Turn This Into a Competitive Advantage Explains how proactive security measures can enhance business appeal. How to Sell This to Your Board Provides strategies to persuade the board about the importance of security. What This Means for Your Business Offers actionable steps for immediate and ongoing cybersecurity measures. Outro Emphasises the importance of proactive cybersecurity measures. Links https://nvd.nist.gov/vuln/detail/CVE-2026-86296 https://nvd.nist.gov/vuln/detail/CVE-2026-75650 https://www.ncsc.gov.uk/
Guarding Against Tenda Router and WordPress Risks In today’s episode of The Daily CVE Update, Corrine Jefferson explores critical vulnerabilities affecting small businesses in the UK. The focus is on two significant threats: Tenda router vulnerabilities (CVE-2026-86152 and CVE-2026-86167) and WordPress plugin vulnerabilities (CVE-2026-16310 and CVE-2026-75816). These vulnerabilities pose severe risks, allowing attackers to gain remote access and reset administrator passwords. Corrine outlines the importance of regular updates and patch management, particularly for small businesses that may feel shielded by their size. She also discusses how addressing these vulnerabilities can be turned into a competitive advantage by strengthening security measures and enhancing business reputation. The episode concludes with Corrine offering actionable recommendations, including auditing network devices, scrutinising CMS security, and ensuring Managed Service Providers are proactive in their approach. By empowering listeners to take decisive actions, Corrine emphasises the need for businesses to stay vigilant and secure. Chapters Intro Corrine sets the stage by highlighting the real threats facing UK small businesses due to online vulnerabilities. Tenda Routers: A Backdoor for Attackers Exploration of critical vulnerabilities in Tenda routers allowing remote access by cybercriminals. CTA Encouragement to follow, rate, review, and share the show with those who will benefit. WordPress Plugins: A Silent Killer Discussion on WordPress plugin vulnerabilities causing admin password resets and their impact on businesses. Competitive Advantage: Turn Chaos into Opportunity How addressing vulnerabilities can be an opportunity to enhance business reputation and security measures. Board-Level Selling Points Strategies for securing executive buy-in by highlighting risks and the necessity of cybersecurity investments. Actionable Recommendations Concrete steps for businesses to audit devices, update systems, and ensure proactive measures with service providers. Outro Corrine concludes with a call to action to take cybersecurity threats seriously and to stay vigilant. Links https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86152 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-86167 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-16310 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-75816
Chrome Zero-Day and WordPress Mass Attack: Patch Today An actively exploited Chrome zero-day and a mass WordPress attack campaign are targeting UK businesses right now. CISA has confirmed active exploitation of CVE-2026-85046, a type confusion vulnerability in Chrome’s V8 JavaScript engine that requires no user interaction beyond visiting a malicious webpage. Over 440,000 exploit attempts have been documented against WordPress sites running vulnerable versions of Super Forms and Elementor Pro plugins. Both issues have patches available, but the gap between patch availability and patch deployment is where incidents happen. This episode walks through the specific actions required today: restarting Chrome browsers across all devices to force update installation, and applying WordPress plugin updates for CVE-2026-14894 and CVE-2026-32475. Corrine explains why small business size offers no protection against automated scanning campaigns, how to verify patches with IT providers, and why documented patch management provides both regulatory defence under UK GDPR Article 32 and commercial differentiation during client procurement. Chapters Intro CISA confirms active exploitation of a Chrome zero-day. Over 440,000 WordPress exploit attempts documented. Both require immediate patching action today. Your Browser Is Being Exploited Right Now CVE-2026-85046 in Chrome’s V8 engine is on CISA’s Known Exploited Vulnerabilities catalogue. Attackers exploit it through malicious webpages with no visible warning. Affects all Chromium-based browsers. Requires browser restart to apply available patches. Verification needed across all devices and browsers including Edge, Opera, and Brave. CTA Request to follow, review, and share the podcast. WordPress Sites Are Under Mass Attack 440,000 exploit attempts targeting CVE-2026-14894 in Super Forms and CVE-2026-32475 in Elementor Pro. Both allow arbitrary PHP file upload and code execution. Automated scanners are hitting all WordPress installations indiscriminately. Successful compromise enables phishing hosting, malware distribution, and data exfiltration. Immediate plugin updates required. The Pattern Behind Both Stories The gap between patch availability and patch application is where incidents occur. Window between disclosure and active exploitation has collapsed. Routine patch management is an operational requirement, not a technical sophistication issue. NCSC guidance identifies patching as highly effective vulnerability management. How This Gives You an Edge Rapid response to threat intelligence is a competitive differentiator in regulated-sector procurement. Timestamped patch documentation provides evidence for GDPR compliance and insurance claims. Requires process, not certification. Making the Case to Your Board Cost asymmetry: patching takes seconds, breaches cost days. Automated attacks do not discriminate by company size. UK GDPR Article 32 requires appropriate technical measures; ignoring available patches creates regulatory exposure with the ICO. Outro Action summary: restart Chrome on all devices and apply all WordPress plugin updates today. Document completion with timestamps for regulatory and insurance purposes. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.wordfence.com/threat-intel/vulnerabilities/ https://www.ncsc.gov.uk/collection/vulnerability-management
Two CVSS 10.0 Flaws in Microsoft Cloud and Active Elementor Pro Exploit On 3 September 2026, the National Vulnerability Database published two critical vulnerabilities in Microsoft’s cloud infrastructure, each scoring CVSS 10.0. CVE-2026-70352 affects Azure AI Language and allows unauthenticated privilege escalation. CVE-2026-83711 targets Azure Active Directory B2C with an authorisation bypass. A third flaw, CVE-2026-62916, scored CVSS 9.1 for an authentication bypass in Microsoft Entra ID. These vulnerabilities sit within the identity and authentication layers used by millions of UK small businesses relying on Microsoft 365 and Azure-based services. Separately, attackers are actively exploiting CVE-2026-32475, a critical file upload vulnerability in Elementor Pro, a WordPress plugin installed on approximately six million websites. The exploit allows remote code execution, leading to backdoor installation and site compromise. This episode provides specific remediation steps: verify Elementor Pro is updated to version 3.27.3 or later, enforce multi-factor authentication across all Microsoft 365 accounts, audit administrator privileges, and obtain written confirmation from managed service providers that cloud environments have been assessed. The episode emphasises that whilst Microsoft deploys cloud-side patches, businesses remain responsible for configuration verification and must understand their exposure to vendor infrastructure vulnerabilities. Chapters Introduction Corrine introduces two simultaneous CVSS 10.0 vulnerabilities in Microsoft’s cloud infrastructure and explains their significance for UK small businesses using Microsoft 365. Two CVSS 10.0 Flaws in Microsoft’s Cloud Detailed analysis of CVE-2026-70352 (Azure AI Language), CVE-2026-83711 (Azure AD B2C), and CVE-2026-62916 (Microsoft Entra ID). Explains the practical implications for authentication and identity infrastructure, vendor response limitations, and specific verification steps including MFA enforcement and administrator account audits. Call to Action Request for listeners to follow the show, leave reviews, and share with other business owners. WordPress and the Elementor Pro Exploit Active exploitation of CVE-2026-32475 in Elementor Pro, affecting approximately six million WordPress sites. Covers the timeline from patch release to confirmed exploitation, the technical impact of remote code execution, GDPR implications, and immediate update requirements to version 3.27.3 or later. What This Means for Your Business Business implications of vulnerability management, the value of demonstrable security posture in procurement and insurance processes, and the importance of MSP accountability. Discusses cost-benefit analysis of proactive patching versus incident response. Practical Takeaways and Conclusion Actionable checklist: update Elementor Pro, verify MFA enforcement, audit admin accounts, question MSPs about Microsoft advisories, and contact Azure AI vendors. Summary of the threat landscape and closing remarks. Links https://nvd.nist.gov/vuln/detail/CVE-2026-70352 https://nvd.nist.gov/vuln/detail/CVE-2026-83711 https://nvd.nist.gov/vuln/detail/CVE-2026-62916 https://nvd.nist.gov/vuln/detail/CVE-2026-32475 https://www.wordfence.com
Sangoma Switchvox and SonicWall SMA1000: CISA Confirms Active Exploits Two critical vulnerabilities affecting business infrastructure have been added to CISA’s Known Exploited Vulnerabilities catalogue, with confirmed active exploitation in the wild. CVE-2026-9586 in Sangoma Switchvox allows unauthenticated remote code execution via SQL injection, affecting approximately 4,000 internet-facing instances. Meanwhile, SonicWall’s SMA1000 remote access gateways are vulnerable to an attack chain combining CVE-2026-83548, a CVSS 10.0 server-side request forgery flaw, with CVE-2026-83549, an OS command injection vulnerability. Both products are common in UK small business environments, and patches are available for all three CVEs. This episode examines the technical mechanisms behind these vulnerabilities, explains why internet-facing infrastructure requires emergency patching outside scheduled maintenance windows, and provides four concrete actions for business owners to verify their systems are protected. The NCSC’s vulnerability management guidance and GDPR Article 32 obligations are discussed in the context of patch management responsibilities. Chapters Intro Corrine introduces two actively exploited vulnerabilities affecting common UK small business infrastructure: phone systems and remote access gateways. CISA added all three CVEs to its Known Exploited Vulnerabilities catalogue on 2 September 2026, confirming real-world exploitation. Your Phone System Is an Open Door CVE-2026-9586 in Sangoma Switchvox allows unauthenticated remote code execution via SQL injection. Approximately 4,000 instances are internet-facing. The vulnerability enables attackers to establish reverse shells, bypassing inbound firewall rules and gaining command-line access without credentials. Patches are available but remain unapplied in many cases. CTA Audience call to action: follow, rate, review, and share the show with others who manage small business IT. The VPN Gateway With a Perfect Vulnerability Score SonicWall SMA1000 appliances are affected by two vulnerabilities forming an attack chain. CVE-2026-83548, a CVSS 10.0 server-side request forgery flaw, requires no authentication. CVE-2026-83549 enables OS command injection with administrator credentials. Together, they allow complete remote compromise of devices designed to protect network perimeters. SonicWall appliances have been used in previous ransomware campaigns. The Pattern the Data Confirms Analysis of the common structure: both vulnerabilities affect infrastructure requiring manual patching, both allow unauthenticated exploitation, and both have available patches that predate active exploitation. The NCSC’s vulnerability management guidance requires prioritising internet-facing systems, and Cyber Essentials certification mandates patching high-risk vulnerabilities within 14 days. Making the Business Case Three arguments for emergency patching: cost asymmetry between patching and breach response, GDPR Article 32 obligations under ICO oversight, and MSP contractual responsibilities for critical infrastructure security. Failing to patch known critical vulnerabilities is difficult to defend during breach investigations. What to Do Before Friday Four concrete actions: identify whether you run affected products, confirm patch status in writing with version numbers, take unpatched devices offline if patching cannot be confirmed, and review patch management SLAs with IT providers to establish defined processes for critical vulnerabilities. Outro Corrine summarises: vulnerabilities are confirmed, patches exist, exploits are active. The only variable under organisational control is whether to act immediately or risk appearing in the next batch of compromised systems. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/collection/vulnerability-management https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/ https://www.ncsc.gov.uk/cyberessentials/overview
Three Critical Password Reset Flaws Expose 22,000 Exchange Servers Three critical vulnerabilities disclosed this week share a common weakness: password reset logic that fails to validate tokens properly. CVE-2026-18550 in the Nokri Job Board WordPress theme allows unauthenticated attackers to hijack admin accounts through an empty token bypass. CVE-2026-84699 in Team Password Manager permits unauthorised password resets without authentication, exposing concentrated credential stores. CVE-2026-84480 in WWBN AVideo allows permanently valid reset tokens with no expiry. Meanwhile, Shadowserver Foundation confirms 22,000 Microsoft Exchange servers remain unpatched against CVE-2026-62911, an authentication bypass allowing unauthenticated mailbox access. This episode examines why account recovery flows represent a systemic weak point in authentication systems, how attackers exploit reset endpoints that lack proper validation, and what UK small businesses should verify with IT providers about password reset security across their entire technology estate. Chapters Introduction Corrine introduces three critical vulnerabilities, all rated CVSS 9.8, that share a common pattern: password reset logic failures that allow attackers to bypass authentication. Three CVEs, One Pattern Detailed examination of CVE-2026-18550 affecting Nokri Job Board theme with empty token bypass, CVE-2026-84699 in Team Password Manager allowing unauthenticated password resets, and CVE-2026-84480 in AVideo with non-expiring reset tokens and no available patch. Call to Action Listener engagement request to follow the show, leave reviews, and share episodes with small business operators and IT managers. Exchange: 22,000 Unpatched Servers Shadowserver Foundation research reveals 22,000 Microsoft Exchange servers remain vulnerable to CVE-2026-62911, an authentication bypass allowing unauthenticated mailbox access. Guidance on obtaining written patch confirmation from IT providers. The Actual Problem With Account Recovery Analysis of why account recovery flows consistently represent the weakest authentication point, how reset endpoints are treated as afterthoughts during development, and why attackers systematically target them with high success rates. What Your Business Should Do Now Five specific actions for the week: audit WordPress installations, verify Team Password Manager versions and rotate credentials, mitigate AVideo exposure, obtain written Exchange patch confirmation, and question IT providers about account recovery security verification across all systems. Closing Concluding reflection that password reset is a trust mechanism requiring verification and maintenance, otherwise becoming the easiest entry point for attackers. Links https://nvd.nist.gov/vuln/detail/CVE-2026-18550 https://nvd.nist.gov/vuln/detail/CVE-2026-84699 https://nvd.nist.gov/vuln/detail/CVE-2026-84480 https://nvd.nist.gov/vuln/detail/CVE-2026-62911 https://www.shadowserver.org/
PaperCut Under Active Attack: Two CVEs, One Failed Patch CISA confirmed on 31 August that two vulnerabilities in PaperCut NG and MF print management software are being actively exploited in the wild. CVE-2026-81578 allows unauthenticated remote attackers to bypass authentication and access admin functions, whilst CVE-2026-82078 enables arbitrary code execution once inside. The vulnerabilities are designed to be chained together, and the initial emergency patch issued by PaperCut was broken by security researchers within days, forcing a second fix. For UK small businesses running PaperCut, this warrants same-day action: confirm your version, verify the second patch has been applied, and restrict internet-facing admin panels to internal network access only. The episode also covers Manic, a new Android banking trojan that exfiltrates credentials through peer-to-peer relay without requiring a direct internet connection, raising questions about SMS-based two-factor authentication on personal devices used for business access. Practical steps include checking your mobile device policy and migrating from SMS codes to authenticator apps where feasible. Chapters Introduction Corrine opens with breaking news: CISA has confirmed active exploitation of two PaperCut vulnerabilities, and the initial patch has already failed. The episode also previews coverage of Manic, a new Android banking trojan with offline credential exfiltration capabilities. PaperCut Actively Exploited: Two CVEs, One Very Messy Patch Detailed breakdown of CVE-2026-81578 (authentication bypass) and CVE-2026-82078 (unsafe reflection enabling code execution), how they chain together, why the first patch failed, and specific steps for UK small businesses to verify patch status, restrict internet-facing access, and contact MSPs in writing for confirmation. Call to Action Corrine encourages listeners to follow, rate, review, and share the show with others who need actionable cybersecurity intelligence. Manic Android Trojan: Banking Credentials Without a Connection Analysis of the Manic banking trojan, which harvests credentials and SMS two-factor authentication codes through a transparent keyboard overlay and exfiltrates data via peer-to-peer relay through other infected devices. Corrine recommends reviewing mobile device policies and migrating from SMS codes to authenticator apps for business-critical systems. Closing Summary Corrine summarises the two stories, reiterates the need for same-day PaperCut patch verification, and recommends one specific action: sending an email to your IT contact or MSP asking for current version and patch confirmation. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.papercut.com/kb/Main/Security-Bulletin-August-2026
Critical Router and WordPress Vulnerabilities Demand Immediate Action This episode examines two urgent threat areas affecting UK small businesses: three critical router vulnerabilities with maximum severity scores and publicly available exploit code, and a cluster of WordPress plugin and theme flaws including an authentication bypass that grants administrator access without credentials. Corrine analyses CVE-2026-82542 affecting the Tenda HG10 router with a CVSS score of 10.0, two critical D-Link DIR-825M vulnerabilities scoring 9.9, and CVE-2026-15980 affecting the MyHome Core WordPress plugin with a score of 9.8. The episode highlights how widely deployed commodity hardware and popular WordPress plugins create exploitable attack surfaces in small office environments. Practical guidance covers identifying affected devices, applying firmware updates, auditing WordPress installations, and establishing basic monthly review processes. The common thread across both threat areas is unmanaged infrastructure: routers and websites that accumulate over time without systematic patching processes. Corrine emphasises that these are not sophisticated attack chains but documented, publicly exploitable flaws in equipment and software currently running in small businesses across the UK. Chapters Introduction Corrine introduces two critical threat areas: router vulnerabilities with maximum severity scores and public exploits, and WordPress flaws including authentication bypass vulnerabilities affecting commodity hardware and websites in UK small businesses. The Router Problem Nobody Is Talking About Analysis of three critical router CVEs: CVE-2026-82542 affecting Tenda HG10 with CVSS 10.0, and CVE-2026-82592 and CVE-2026-82593 affecting D-Link DIR-825M both scoring 9.9. Examination of why these widely deployed devices represent a persistent structural problem in small business network security, with practical steps for checking models and applying firmware updates. Call to Action Brief request for listeners to follow the show, leave ratings and reviews, and share the episode with small business owners managing office networks. WordPress: When Your Website Becomes the Attack Vector Detailed coverage of CVE-2026-15980 in MyHome Core plugin scoring 9.8, which allows unauthenticated attackers to obtain administrator cookies. Discussion of critical flaws in WPMU DEV Dashboard, Avada, TranslatePress, Pods, and GiveWP, with guidance on auditing WordPress installations and removing unused plugins. The Common Thread: Unmanaged Infrastructure Examination of how both router and WordPress vulnerabilities stem from the same underlying issue: absence of systematic patch management processes in small businesses. Discussion of how basic monthly review processes can provide competitive advantage and support Cyber Essentials compliance. Conclusion Summary of critical actions required this week: checking router models, applying WordPress updates, auditing installed plugins, and establishing consistent monthly patch management processes.
Authentication Bypass and Linux Kernel Flaws Under Active Exploitation Three critical vulnerabilities have been confirmed as actively exploited in the wild, triggering urgent additions to CISA’s Known Exploited Vulnerabilities catalogue. CVE-2023-49105, an authentication bypass in ownCloud, allows attackers to access, modify, or delete files without credentials when only a username is known. Despite being disclosed in 2023, active exploitation has only now escalated. CVE-2026-53362, a Linux kernel privilege escalation flaw affecting major distributions and cloud infrastructure, enables attackers to gain full administrative control from limited footholds. Two openssl_encrypt vulnerabilities (CVE-2026-81702 and CVE-2026-81707) permit sophisticated identity spoofing attacks, compromising encrypted communications and fingerprint verification mechanisms. For UK small businesses, the regulatory exposure is concrete: unauthenticated file access triggers UK GDPR breach notification obligations, and running unpatched software with confirmed active exploits undermines defensibility to the ICO. This episode provides specific, actionable steps to verify patch status with IT providers and MSPs, establish documented accountability, and meet Cyber Essentials compliance requirements within the scheme’s fourteen-day patching window for high-severity actively exploited CVEs. Chapters Introduction Corrine introduces three actively exploited vulnerabilities confirmed by CISA, including an authentication bypass requiring only a username to compromise systems. ownCloud Authentication Bypass: CVE-2023-49105 Analysis of CVE-2023-49105, an ownCloud vulnerability disclosed in 2023 but now under active exploitation, allowing unauthenticated file access, modification, and deletion with UK GDPR breach implications. Call to Action Request to follow, rate, review, and share the podcast to support ongoing critical vulnerability coverage for UK small businesses. Linux Kernel Privilege Escalation: CVE-2026-53362 Examination of CVE-2026-53362, a Linux kernel IPv6 privilege escalation flaw affecting cloud infrastructure, hosting providers, and network appliances, with Cyber Essentials compliance implications. openssl_encrypt Identity Spoofing: CVE-2026-81702 and CVE-2026-81707 Coverage of two critical openssl_encrypt vulnerabilities enabling public key substitution and fingerprint verification manipulation in encrypted communications and identity verification systems. Business Case and Pre-Friday Actions Regulatory, competitive, and procurement arguments for addressing these vulnerabilities, with five specific actions to complete before end of week, including MSP accountability and patch documentation. Conclusion Closing remarks emphasising the three-year gap between CVE-2023-49105 disclosure and active exploitation, urging immediate action on clear intelligence guidance. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://owncloud.com/security-advisories/ https://www.ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/personal-data-breaches/ https://www.ncsc.gov.uk/cyberessentials/overview
SQL Server, WordPress Avada, and Gitea Under Active Exploitation Three critical vulnerabilities are being actively exploited in the wild, all with patches available. Microsoft SQL Server’s CVE-2019-1068, a remote code execution flaw first patched in 2019, remains weaponised against unpatched systems seven years later. WordPress sites running the Avada theme and Fusion Builder plugin face a 9.8-rated vulnerability (CVE-2026-18431) allowing unauthenticated attackers to achieve full site compromise. Gitea, the self-hosted Git service, is being targeted via CVE-2026-60004, enabling arbitrary code execution through malicious Git hooks. CISA has confirmed all three as actively exploited. This episode explains the technical impact of each vulnerability, identifies the patched versions required, and sets out immediate actions for UK small businesses: verifying SQL Server patch status with IT providers, updating WordPress components to Avada 7.17 and Fusion Builder 3.17, auditing Gitea instances, and formalising patch management processes to meet Cyber Essentials requirements and avoid ICO enforcement action. Chapters Intro Corrine introduces today’s briefing on three actively exploited vulnerabilities from CISA’s Known Exploited Vulnerabilities catalogue, highlighting a troubling pattern: attackers still successfully exploit a seven-year-old SQL Server flaw because patch management remains broken across organisations. SQL Server: A Seven-Year-Old Wound That’s Still Bleeding CVE-2019-1068 allows remote code execution on Microsoft SQL Server instances. Despite a patch being available since 2019, CISA confirms active exploitation in 2026. Businesses must verify patch status immediately with IT providers and document responses in writing. CTA Corrine asks listeners to follow, rate, review, and share the show, especially with those managing WordPress sites or SQL Server instances who need to act today. WordPress: Avada, Fusion Builder, and a 9.8 You Can’t Ignore CVE-2026-18431 affects the widely used Avada theme and Fusion Builder plugin, scoring 9.8 on CVSS. Unauthenticated attackers can achieve remote code execution. Both Avada 7.17 and Fusion Builder 3.17 must be installed. TranslatePress CVE-2026-19632 is also flagged. Automated scanners are already probing for these flaws at scale. Gitea: The Developer Tool That’s Now a Target CVE-2026-60004 allows arbitrary code execution on self-hosted Gitea instances via malicious Git hooks. If open registration is enabled, unauthenticated visitors can achieve full compromise. Businesses should audit whether development partners use Gitea and confirm patching status. Making the Practical Case Corrine outlines three arguments for prioritising patches: exploitation costs exceed patching costs, CISA’s KEV catalogue confirms real attacks not theoretical risk, and patch management is auditable under Cyber Essentials. The ICO treats unpatched known vulnerabilities as negligence. What to Do Before Friday Specific actions: check WordPress installations for Avada, Fusion Builder, and TranslatePress versions; verify SQL Server patch status in writing; audit Gitea exposure with development partners; enable automatic updates where practical; request patch status reports from MSPs. Outro Corrine closes with the core message: patch management is the most impactful, accessible action small businesses can take. All three vulnerabilities are fixable before Friday if action is taken today. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-1068 https://nvd.nist.gov/vuln/detail/CVE-2026-18431 https://nvd.nist.gov/vuln/detail/CVE-2026-60004 https://nvd.nist.gov/vuln/detail/CVE-2026-19632 https://www.ncsc.gov.uk/cyberessentials/overview https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
Adobe Campaign, WordPress Login Bypass, and Gitea Code Injection Three CVSS 10.0 vulnerabilities landed in Adobe Campaign Classic within 24 hours, all enabling unauthenticated remote code execution. Attackers are actively exploiting an authentication bypass in the WordPress miniOrange SAML plugin that grants full administrator access without credentials. CISA has confirmed active exploitation of a Gitea code injection flaw that allows attackers with repository write access to execute arbitrary commands. This episode examines why these vulnerabilities matter to UK small businesses even when the affected software isn’t directly deployed in-house. Corrine explains how supply chain relationships with marketing agencies, MSPs, and web developers create exposure, outlines the GDPR accountability implications, and provides specific remediation steps including supplier verification questions, WordPress plugin audit procedures, and Gitea access controls. Chapters Introduction Three CVSS 10.0 scores in Adobe Campaign Classic, active exploitation of WordPress login bypass, and CISA-confirmed Gitea code injection all emerged within 24 hours. Adobe Campaign Classic: Three CVSS 10.0 Scores in 24 Hours CVE-2026-76193, CVE-2026-76195, and CVE-2026-76197 enable unauthenticated remote code execution. Supply chain exposure through marketing agencies and email service providers creates risk for small businesses even without direct deployment. Call to Action Listener engagement request for ratings, reviews, and sharing. WordPress Admin Bypass: No Password Required Active exploitation of CVE-2026-15981 in miniOrange SAML 2.0 plugin allows unauthenticated attackers to gain full administrator access. Plugin audit and update procedures outlined. Gitea Code Injection: Confirmed Exploited CVE-2026-60004 added to CISA Known Exploited Vulnerabilities catalogue. Attackers with repository write access can execute arbitrary commands. Access control audit required. Why This Week’s Stories Are a Supply Chain Problem Small businesses face exposure through third-party service providers. GDPR accountability extends to data processors and sub-processors regardless of direct deployment. What to Do Before Friday Five-point action list: verify Adobe Campaign Classic patch status with suppliers, audit WordPress plugins, patch Gitea instances, contact service providers with specific questions, subscribe to NCSC alerts. Closing Recap of the three vulnerability families and emphasis on supplier verification as the most critical immediate action. Links https://www.first.org/cvss/ https://nvd.nist.gov/vuln/detail/CVE-2026-76193 https://nvd.nist.gov/vuln/detail/CVE-2026-76195 https://nvd.nist.gov/vuln/detail/CVE-2026-76197 https://nvd.nist.gov/vuln/detail/CVE-2026-15981 https://nvd.nist.gov/vuln/detail/CVE-2026-60004 https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/section/keep-up-to-date/vulnerability-management https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/ https://w3techs.com/technologies/details/cm-wordpress
Critical Flaws in HTML Sanitiser and Spreadsheet Library This episode examines five critical vulnerabilities published within 24 hours, all scoring CVSS 9.4 or above. Four CVEs affect justhtml, a Python HTML sanitisation library, exposing bypass techniques including encoded malicious URLs, mixed-case tag names, and downstream Markdown conversion flaws. The fifth, CVE-2026-78207, concerns exceljs-hardened, a Node.js spreadsheet library vulnerable to prototype pollution through malicious cell notes. Corrine explains the practical attack scenarios, including unauthenticated file upload exploitation, and provides clear remediation steps. The episode emphasises supply chain visibility, noting that while these vulnerabilities are not currently on CISA’s Known Exploited Vulnerabilities catalogue, they represent genuine risk for small businesses with affected dependencies. Guidance covers patch priorities, GDPR reporting obligations for sanitisation failures, and practical steps for establishing software inventory and NVD notification processes without significant cost. Chapters Introduction Corrine introduces five critical vulnerabilities published within 24 hours, all in underlying software libraries rather than headline applications, and explains why they matter to UK small businesses. The justhtml Cluster: Four CVEs, One Library Detailed examination of four vulnerabilities in justhtml, a Python HTML sanitisation library. Covers CVE-2026-5388 (URL helpers and Markdown passthrough bypasses), CVE-2026-7808 (mixed-case tag names), and CVE-2026-8445 (Markdown conversion function failures), all scoring CVSS 9.8. Call to Action Brief pause encouraging listeners to follow the show and share with other small business owners. exceljs-hardened: Prototype Pollution in a Spreadsheet Tool Analysis of CVE-2026-78207, a CVSS 9.4 prototype pollution vulnerability in exceljs-hardened affecting versions below 5.0.0. Explains the attack mechanism through malicious spreadsheet uploads and realistic exploitation scenarios. What the Data Actually Tells You Contextualises the vulnerabilities by noting their absence from CISA’s Known Exploited Vulnerabilities catalogue, and provides calibrated guidance on prioritisation and remediation timelines. Supply Chain Visibility and What It Costs You Discusses the commercial value of supply chain visibility, procurement tender requirements, practical steps for establishing software inventory, and UK GDPR obligations regarding known vulnerabilities. Conclusion Summary of the five vulnerabilities, specific version upgrade requirements, and practical next steps for small businesses including setting up NVD notifications and establishing baseline dependency awareness. Links https://nvd.nist.gov/vuln/detail/CVE-2026-5388 https://nvd.nist.gov/vuln/detail/CVE-2026-7808 https://nvd.nist.gov/vuln/detail/CVE-2026-8445 https://nvd.nist.gov/vuln/detail/CVE-2026-78207 https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/collection/supply-chain-security https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/
Active Exploitation of TrueConf, Microsoft CVSS 10.0 Flaws, and Elementor Pro On 20 August 2026, CISA confirmed active exploitation of two TrueConf Server vulnerabilities allowing unauthenticated remote code execution. The same day, Microsoft disclosed four separate CVSS 10.0 vulnerabilities affecting Exchange Online, Entra ID, Azure Arc, and Azure Managed Instance for Apache Cassandra. Meanwhile, six million WordPress sites face exposure through a critical unauthenticated file upload flaw in Elementor Pro. For UK small businesses, these disclosures highlight a consistent pattern: the attack surface extends beyond directly owned infrastructure to suppliers, cloud services, and website platforms. This episode examines each vulnerability in detail, explains the supply chain implications, and provides five actionable steps to assess exposure before the end of the week. Whether your risk sits with an MSP running TrueConf, a WordPress site built years ago and quietly forgotten, or a Microsoft 365 tenant with no audit logging enabled, the common thread is visibility and ownership. Without knowing what’s in your environment, who is responsible for patching, and whether anyone is reviewing the logs, you cannot defend it. This episode makes the business case for addressing these gaps and offers practical guidance grounded in the Cyber Essentials standard and UK GDPR obligations. Chapters Introduction Corrine introduces three critical security disclosures from 20 August 2026: CISA’s confirmation of active exploitation of TrueConf Server vulnerabilities, Microsoft’s disclosure of four CVSS 10.0 flaws, and a critical Elementor Pro WordPress plugin vulnerability affecting six million sites. TrueConf Server: Two KEV Entries, Actively Exploited CISA added CVE-2026-72529 and CVE-2026-72530 to the Known Exploited Vulnerabilities catalogue. Both allow unauthenticated remote code execution on TrueConf Server. The vulnerabilities form a complete attack chain from network access to full host compromise, with confirmed active exploitation. CISA mandates immediate vendor mitigations or discontinuation of the product. Call to Action Listeners are encouraged to follow the show, leave ratings, and share the episode with others who would benefit from actionable cybersecurity intelligence. Microsoft’s Overnight Disclosure: Four CVSS 10.0 Flaws Microsoft disclosed four maximum-severity vulnerabilities on 20 August 2026. CVE-2026-65770 affects Azure Managed Instance for Apache Cassandra. CVE-2026-65801 affects Exchange Online. CVE-2026-65816 and CVE-2026-69555 affect Azure Arc. CVE-2026-69836 affects Microsoft Entra ID. All allow unauthenticated remote code execution or privilege escalation. These components underpin Microsoft 365 and Azure infrastructure used widely by UK small businesses. Elementor Pro: Six Million WordPress Sites at Risk CVE-2026-32475 is a critical unauthenticated file upload vulnerability in Elementor Pro, a WordPress page builder plugin installed on six million sites. The flaw allows attackers to upload PHP files and achieve full site takeover, including persistent backdoors and malicious administrator accounts. Patchstack expects active exploitation to follow disclosure. Many UK small business websites lack formal ownership of plugin updates. Why This Matters for Your Supply Chain Attack surfaces extend beyond directly owned infrastructure to suppliers, MSPs, cloud platforms, and website hosting. TrueConf may reside in supplier environments. Elementor Pro likely exists on forgotten WordPress sites. Microsoft 365 flaws require tenant-level monitoring. Without visibility into these dependencies, businesses cannot assess or mitigate risk. Making the Business Case Three arguments support investment in patching and monitoring: the cost of a breach under UK GDPR includes notification obligations and ICO investigations; Cyber Essentials mandates patching critical vulnerabilities within fourteen days; and monitoring costs less than post-incident discovery. Basic Microsoft 365 audit logging is included in most subscriptions and costs nothing to enable. What to Do Before Friday Five specific actions: verify TrueConf exposure with IT providers; update Elementor Pro on WordPress sites; enable Microsoft 365 audit logging; review Entra ID sign-in logs for anomalies; and confirm MSP patch SLAs meet the fourteen-day Cyber Essentials standard. These steps provide immediate visibility and reduce exposure. Conclusion The episode reinforces that attack surfaces in 2026 encompass suppliers, website platforms, and cloud dependencies. Knowing what is in the environment, who owns updates, and whether logs are reviewed are foundational to effective defence. Corrine closes with a reminder to return tomorrow for continued daily intelligence. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://msrc.microsoft.com/update-guide/ https://patchstack.com/database/ https://www.ncsc.gov.uk/cyberessentials/overview https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/
Active Exploitation of MSP Tools, CCTV Systems and Windows VPNs This episode examines three concurrent exploitation campaigns targeting UK small business infrastructure in August 2026. First, CVE-2026-18577 in N-able N-central RMM software, which grants unauthenticated administrative access to MSP management consoles and, by extension, every client system they control. Second, Operation CameraSwarm, a coordinated campaign that compromised over 14,530 Dahua CCTV devices using five-year-old unpatched vulnerabilities and default credentials. Third, CVE-2026-33824, a critical Windows IKE vulnerability patched in April 2026 but added to CISA’s Known Exploited Vulnerabilities catalogue in August following confirmed active exploitation. Corrine analyses the common thread: attackers are systematically targeting outsourced infrastructure that businesses stop monitoring after deployment. The episode provides specific remediation steps, including how to request patch compliance documentation from managed service providers, how to audit CCTV firmware versions, and how to verify Windows patch status against the CISA KEV catalogue. Practical guidance is given on converting threat intelligence into procurement advantages and compliance evidence for Cyber Essentials certified businesses. Chapters Introduction Corrine introduces three active exploitation campaigns targeting outsourced and overlooked infrastructure in UK small businesses during August 2026. The Master Key Problem Analysis of CVE-2026-18577 in N-able N-central RMM software, which allows unauthenticated administrative access to MSP management consoles and every client system they control. Includes specific steps for requesting written patch confirmation from service providers. Call to Action Request for audience engagement through follows, ratings, reviews and sharing. 14,530 Cameras, None of Them Secure Breakdown of Operation CameraSwarm, which compromised over 14,530 Dahua CCTV devices between June and July 2026 using default credentials and five-year-old unpatched vulnerabilities CVE-2021-33044 and CVE-2021-33045. Practical guidance on firmware audits and credential management. A Patch From April That Nobody Applied Examination of CVE-2026-33824, a critical Windows IKE vulnerability patched in April 2026 but added to CISA’s Known Exploited Vulnerabilities catalogue in August following confirmed exploitation. Discussion of the four-month window between patch availability and active exploitation. Turning This Into an Advantage Strategic analysis of how proactive threat intelligence monitoring and documented security posture create procurement advantages and support Cyber Essentials compliance requirements. What to Do Before Friday Seven specific remediation actions: requesting written MSP patch confirmation, auditing Dahua firmware and credentials, verifying Windows patch compliance, extending scrutiny to all third-party access, and establishing weekly CISA KEV catalogue review. Closing Remarks Corrine summarises the common exploitation pattern across outsourced infrastructure and emphasises the importance of documentation over reassurance. Links https://www.n-able.com/security-and-privacy/cve-2026-18577 https://www.cyber.gov.au/about-us/advisories/n-able-n-central-critical-vulnerability https://hunt.io/blog/operation-cameraswarm-dahua-device-compromise https://www.cve.org/CVERecord?id=CVE-2021-33044 https://www.cve.org/CVERecord?id=CVE-2021-33045 https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33824 https://www.dahuasecurity.com/support/firmware
SharePoint Zero-Auth Bypass, macOS Screen Sharing Flaw, Copilot Data Leak Three critical vulnerabilities confirmed as actively exploited demand immediate attention from UK small businesses. CVE-2026-55040 allows unauthenticated attackers to bypass SharePoint authentication entirely, no credentials required. CVE-2026-65400 lets attackers on your local network gain full control of unpatched Macs through Screen Sharing without valid credentials. CVE-2026-24301, now patched, demonstrated how a single crafted link could silently exfiltrate data from Microsoft Copilot Personal. Corrine walks through the practical threat model for each vulnerability, why CISA’s Known Exploited Vulnerabilities catalogue additions matter, and the specific actions UK small businesses must take today: patch SharePoint or restrict access immediately, update all Macs to macOS Tahoe 26.6.2, verify Copilot versions and audit connected services. This episode emphasises the gap between Cyber Essentials compliance timelines and the reality of active exploitation, the false security of local network restrictions, and the emerging attack surface created by AI tools with broad data access. Chapters Introduction Three vulnerabilities added to CISA’s Known Exploited Vulnerabilities catalogue overnight, two requiring zero credentials to exploit, including one in the AI assistant staff are likely using. CVE-2026-55040: SharePoint Authentication Bypass Microsoft SharePoint authentication bypass allows unauthenticated network attackers complete access. CISA KEV listing confirms active exploitation. Immediate patching or access restriction required for internet-facing SharePoint instances used by UK small businesses through Microsoft 365. Call to Action Listener engagement request: follow, rate, review, and share the show to help more UK small businesses respond to threats. CVE-2026-65400: Apple macOS Screen Sharing Improper authentication in macOS Screen Sharing allows local network attackers full remote control without credentials. Threat model includes office Wi-Fi, guest networks, VPN connections, and compromised pivot points. Apple released macOS Tahoe 26.6.2 to address the flaw. CVE-2026-24301: Copilot Data Exfiltration Microsoft Copilot Personal vulnerability, now patched, allowed silent data exfiltration via crafted links executing attacker-controlled prompts. Demonstrates prompt injection risks in commercial AI tools. Guidance on auditing AI tool data access and limiting blast radius. Conclusion Summary of three confirmed active exploits and specific actions required: patch SharePoint immediately, update all Macs to macOS Tahoe 26.6.2 today, verify Copilot versions and audit connections. The cost of patching is time; the cost of not patching is breach notifications and incident response. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog
WordPress Plugin and Router Botnet Threats Demand Immediate Patching This episode examines two active cybersecurity threats affecting UK small businesses: CVE-2026-15748, a critical unauthenticated remote code execution vulnerability in the Forminator Forms WordPress plugin with over 600,000 installations, and Evooo1Bot, a Linux botnet targeting unpatched routers and edge devices using decade-old vulnerabilities. Corrine explains how both threats exploit the absence of basic patching practices, why automated scanning makes business size irrelevant as a defence, and provides practical steps for checking WordPress plugin versions and router firmware. The episode connects these immediate threats to broader patterns covered throughout the series, including Cyber Essentials requirements, UK GDPR obligations when breached through known vulnerabilities, and the commercial value of demonstrable security hygiene. With clear instructions for non-technical business owners and guidance on engaging IT providers, the briefing translates intelligence feed data into actionable tasks that cost nothing but demand attention today. Chapters Introduction Corrine introduces two active threats targeting infrastructure commonly used by UK small businesses: WordPress websites and office routers, both requiring immediate attention. 600,000 WordPress Sites, One Plugin, No Login Required Analysis of CVE-2026-15748, a critical unauthenticated remote code execution vulnerability in Forminator Forms WordPress plugin, with practical steps for checking and updating plugin versions. Community Support Request Brief call to action encouraging listeners to follow, review, and share the podcast with other small business owners. Your Router May Already Be Someone Else’s Infrastructure Examination of Evooo1Bot, a Linux botnet exploiting vulnerabilities dating back to 2016 to turn routers into SOCKS5 proxies, with guidance on checking and updating router firmware. What These Two Stories Have in Common Discussion of the shared logic behind both threats: automated, opportunistic scanning that treats all internet-connected systems equally regardless of business size or sector. Making the Business Case Three practical arguments for prioritising patching: zero remediation cost, documented active exploitation, and commercial value of demonstrable security hygiene including Cyber Essentials alignment. Conclusion and Action Items Summary of two immediate tasks: checking WordPress plugins and router firmware, with guidance for businesses that outsource technical management. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog
Critical Router, WordPress, and VMware Exploits Now Public Three critical security vulnerabilities with publicly available exploit code were disclosed on 16 August 2026, requiring immediate action from UK small businesses. This episode covers CVE-2026-19959 and CVE-2026-19961 affecting Edimax EW-7478APC routers (both scoring 9.9 on the CVSS scale), CVE-2026-16098 in the ProSolution WP Client WordPress plugin enabling unauthenticated file upload, CVE-2026-18432 in Frontend Admin by DynamiApps allowing privilege escalation to administrator level, and CVE-2026-59310, a directory traversal flaw in VMware vCenter Server. Corrine explains what each vulnerability means in practical terms, who is affected, and provides specific actions for business owners: checking router models, auditing WordPress plugins, and questioning managed service providers about vCenter patching status. The episode emphasises the distinction between theoretical vulnerabilities and those with active exploits, the importance of documented remediation actions for UK GDPR Article 32 compliance, and the supply chain risks inherent in third-party infrastructure management. Chapters Introduction Corrine introduces three critical vulnerability disclosures with publicly available exploit code, explaining the critical difference between theoretical vulnerabilities and those actively exploitable. Edimax Router Vulnerabilities Analysis of CVE-2026-19959 and CVE-2026-19961 affecting Edimax EW-7478APC routers, both scoring 9.9 on CVSS. Covers remote code execution risks, vendor non-responsiveness, and immediate replacement recommendations. Call to Action Brief request for listeners to follow, rate, review, and share the programme. WordPress Plugin Vulnerabilities Examination of CVE-2026-16098 in ProSolution WP Client (unauthenticated file upload) and CVE-2026-18432 in Frontend Admin by DynamiApps (privilege escalation). Includes specific remediation steps for WordPress site owners. VMware vCenter Vulnerability Discussion of CVE-2026-59310, a directory traversal flaw in VMware vCenter Server, with focus on supply chain risk and the need to verify MSP patching status. Conclusion Summary of required actions, emphasis on documentation for UK GDPR Article 32 compliance, and the importance of consistent response to threat intelligence. Links https://nvd.nist.gov/vuln/detail/CVE-2026-19959 https://nvd.nist.gov/vuln/detail/CVE-2026-19961 https://nvd.nist.gov/vuln/detail/CVE-2026-16098 https://nvd.nist.gov/vuln/detail/CVE-2026-18432 https://nvd.nist.gov/vuln/detail/CVE-2026-59310
WordPress Backdoors and SharePoint Exploits: Two Preventable Threats Two critical vulnerabilities demand immediate attention from UK small businesses. WordPress plugins Fluent Forms Pro and Ninja Tables Pro were distributed with backdoored updates that bypass authentication, establish hidden API endpoints, and persist even after plugin removal (CVE-2026-73532 and CVE-2026-73533, both rated CVSS 9.8). Separately, Microsoft SharePoint faces active exploitation after proof-of-concept code emerged for an authentication bypass vulnerability (CVE-2026-55040), which when combined with CVE-2026-63520 enables unauthenticated remote code execution. Both threats were preventable through basic operational hygiene: verifying plugin sources and applying available patches. UK businesses running WordPress must check for unexpected PHP files in mu-plugins and uploads directories, audit administrator accounts, and verify clean backups. Those with on-premises SharePoint installations must confirm patch status immediately, particularly if working towards Cyber Essentials certification. The episode examines the compressed exploitation timeline, UK GDPR implications, and specific remediation steps for each vulnerability. Chapters Introduction: Preventable Doors Left Open Corrine introduces two critical vulnerabilities affecting UK small businesses, both preventable through basic operational hygiene rather than expensive security technology. WordPress Plugin Backdoor via Poisoned Updates Analysis of compromised WordPress plugins Fluent Forms Pro and Ninja Tables Pro (CVE-2026-73532 and CVE-2026-73533), which established hidden REST API backdoors, persistent PHP files, and passwordless administrator accounts through tampered update mechanisms. Covers UK GDPR implications and specific remediation steps beyond simple plugin removal. Follow and Share The Daily CVE Update Brief call to action encouraging listeners to follow, review, and share the show with fellow business owners and IT managers. SharePoint Authentication Bypass Under Active Exploitation Examination of CVE-2026-55040 and CVE-2026-63520 affecting on-premises SharePoint installations, detailing the compressed timeline from patch availability to active exploitation following proof-of-concept publication. Addresses Cyber Essentials compliance requirements and MSP accountability. Practical Summary and Operational Guidance Actionable checklist for both vulnerabilities, emphasising verification steps for WordPress installations and patch confirmation for SharePoint environments, with focus on building consistent security posture over time. Links https://www.rapid7.com/blog/post/2026/08/11/cve-2026-55040-sharepoint-authentication-bypass/ https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55040 https://www.wordfence.com/blog/2026/08/fluent-forms-ninja-tables-compromised/ https://www.ncsc.gov.uk/cyberessentials/overview
Critical Vulnerabilities Threatening UK Businesses In today’s episode of The Daily CVE Update, Corrine explores critical vulnerabilities affecting UK small businesses. With cybercriminals casting wider nets, businesses must remain vigilant. We delve into Spikster’s unprotected API routes, scoring 9.8 on the CVSS, and the consequences of such vulnerabilities. Attention then shifts to IBM’s App Connect Enterprise and WebMethods Integration, both grappling with severe directory traversal risks. WordPress also faces challenges with the CVE-2026-63030 flaw. The episode highlights the importance of seeing vulnerabilities as opportunities for reinforcing security and building trust. Corrine urges listeners to discuss these issues with their boards, align with the National Cyber Security Centre’s guidance, and take actionable steps to secure their systems and educate their teams. Chapters Intro Corrine introduces the episode’s theme: vulnerabilities facing UK small businesses. Top Priority: Spikster’s Unprotected API Routes Discusses Spikster’s CVE-2026-67594 vulnerability and its implications. CTA Encourages listeners to follow the podcast, leave a rating, and share feedback. IBM Woes: App Connect and Integration at Risk Examines vulnerabilities in IBM App Connect Enterprise and WebMethods Integration. WordPress: Old Habits Die Hard Explores a vulnerability in WordPress allowing remote code execution. Turning Vulnerability into Opportunity Highlights how addressing vulnerabilities can enhance business reputation. Talking to the Board: Why This Matters Now Guides on discussing cybersecurity with board members and promoting proactive action. What To Do Next Provides actionable steps to secure systems and educate staff. Outro Concludes with encouragement to remain vigilant and proactive against threats. Links https://www.cvedetails.com
Addressing IBM WebSphere Vulnerabilities In this episode of The Daily CVE Update, Corrine Jefferson discusses critical vulnerabilities in IBM WebSphere, which pose a severe risk to small UK businesses. With vulnerabilities like CVE-2026-14512 allowing remote attackers to bypass authentication and CVE-2026-14446 enabling privilege escalation, the potential threat to IT infrastructure is significant. Corrine highlights the practical steps businesses must take to mitigate these risks, including prompt patch updates and reassessing IT security measures. The episode also explores other notable threats such as JetBrains TeamCity and Baseboard Management Controllers. Corrine emphasizes the competitive advantage proactive security measures can offer, urging executives to prioritise cybersecurity to ensure customer trust and regulatory compliance. Listeners are encouraged to make regular security updates a routine and foster a security-first culture within their organisations. Chapters Intro Corrine introduces the episode, focusing on a significant vulnerability within IBM WebSphere that affects UK businesses. Critical Vulnerabilities in IBM WebSphere Details on vulnerabilities CVE-2026-14512 and CVE-2026-14446 and their implications for IT infrastructure security. Practical Impact Discussion on the serious risks these vulnerabilities pose to small businesses, including data exposure and reputational damage. CTA Encouraging listeners to subscribe, rate, and share the podcast to spread awareness. Other Major Threats Introduction to additional security threats such as JetBrains TeamCity and Baseboard Management Controllers. Competitive Advantage Through Proactiveness Exploration of how addressing vulnerabilities can position businesses as security leaders, offering a competitive edge. Selling Points for Executives Focusing on risk mitigation, regulatory alignment, and maintaining customer trust for executives. What to Do Next Detailed action plan for businesses to implement security measures and keep up with the latest threats. Outro Conclusion emphasising the significance of cybersecurity as a continuous priority and a source of competitive advantage. Links https://nvd.nist.gov/vuln/detail/CVE-2026-14512 https://nvd.nist.gov/vuln/detail/CVE-2026-14446 https://nvd.nist.gov/vuln/detail/CVE-2026-63077 https://nvd.nist.gov/vuln/detail/CVE-2013-4786
Critical Vulnerabilities: FortiOS and VeloCloud Threats In this episode of The Daily CVE Update, Corrine discusses crucial vulnerabilities affecting UK small businesses, focusing on FortiOS and VeloCloud Orchestrator. FortiOS’s CVE-2025-68686 allows data breaches by bypassing earlier patches, while VeloCloud’s CVE-2026-16812 enables remote access through OS command injection. These issues threaten sensitive data and business operations, emphasising the need for immediate action. Corrine outlines steps for businesses to protect themselves, including patching systems, evaluating network exposure, monitoring for intrusions, maintaining backup systems, and conducting security audits. She also discusses how turning these challenges into opportunities can distinguish businesses as security leaders. Business owners are encouraged to view this crisis as a chance to reinforce their security posture and boost their industry credibility. Chapters Intro Introduction to the episode and overview of the critical vulnerabilities in FortiOS and VeloCloud. Why These Vulnerabilities Matter Explanation of the FortiOS and VeloCloud vulnerabilities and their potential impacts on data security. What’s at Stake: Immediate Impacts Discussion of the practical consequences of these vulnerabilities, including access, continuity, reputation, and compliance risks. Solutions: What UK SMBs Need to Do Now Steps for UK small businesses to mitigate risks, including patching, evaluating exposure, monitoring, backing up, and auditing. CTA Encouragement for listeners to act on the advice given, follow the podcast, and engage with the content. Competitive Edge: Turn This Crisis Into Opportunity How businesses can use their response to the vulnerabilities as a marketing and trust-building opportunity. Board-Level Selling Points Advice on how to communicate the urgency and importance of responding to security threats to business leadership. Outro Closing thoughts, a reminder of continuous security processes, and an invitation to join the next episode. Links https://nvd.nist.gov/vuln/detail/CVE-2025-68686 https://nvd.nist.gov/vuln/detail/CVE-2026-16812
Critical Cyber Vulnerabilities Affecting UK Businesses In today’s episode of The Daily CVE Update, hosted by Corrine, we explore significant cybersecurity threats facing UK small businesses. We begin with the Fastjson library vulnerability, known as CVE-2026-16723, which poses a severe risk due to its ability to allow remote code execution without a current patch. Next, we analyse the dangers of Cl0p ransomware, exploiting weaknesses in PTC Windchill and FlexPLM, specifically targeting CVE-2026-12569. The discussion offers actionable steps for businesses to protect their assets, enhance monitoring, and fortify their digital defences. Additionally, we delve into leveraging security practices as a competitive advantage and make a compelling business case for increased cybersecurity investment. With insights from reputable sources such as the National Cyber Security Centre and CISA, the episode underscores the importance of proactive measures in safeguarding against breaches that can harm reputation and financial stability. Chapters Intro Introduction to the episode’s key topics: critical cybersecurity threats for UK businesses. The Fastjson Vulnerability: A Wake-up Call for Developers Exploration of the Fastjson library vulnerability CVE-2026-16723. Implications for developers and businesses, highlighting the need for immediate action. CTA Encouragement to follow the show and support its mission of delivering critical cybersecurity insights. Cl0p Ransomware: Targeting the Unprepared Analysis of Cl0p ransomware’s exploitation of vulnerabilities in PTC systems. Emphasis on the danger to intellectual property. How to Use This Information as a Competitive Advantage Guidance on turning security practices into a business advantage by proactively managing and securing assets. Making the Business Case Strategies for convincing stakeholders of the financial benefits of proactive cybersecurity investment. What to Do Next Actionable steps for firms to improve their cybersecurity posture, from auditing dependencies to enhancing employee training. Outro Closing remarks reinforcing the importance of staying informed and proactive in cybersecurity defences. Links https://nvd.nist.gov/vuln/detail/CVE-2026-16723 https://nvd.nist.gov/vuln/detail/CVE-2026-12569 https://www.ncsc.gov.uk https://www.cisa.gov
Critical Threats: Microsoft Exchange and Azure Vulnerabilities In this episode of The Daily CVE Update, Corrine delves into critical vulnerabilities affecting Microsoft Exchange Online and Azure DNS, known as CVE-2026-56191 and CVE-2026-58275. These threats pose significant risks, allowing unauthorised attackers potential access to sensitive email content and cloud infrastructure. For UK small and medium-sized businesses, ignoring these vulnerabilities could lead to severe data breaches, financial losses, and reputational damage. Corrine offers practical advice on how businesses can protect themselves, including immediate patching, implementation of multi-factor authentication, and stringent access controls. By securing their systems, businesses not only ensure safety but also gain a competitive edge by demonstrating robust cybersecurity to clients and stakeholders. Corrine shares insights on communicating these issues effectively to boards using the language of risk and reward, and underscores the importance of compliance with regulatory requirements. Chapters Intro Corrine introduces critical vulnerabilities in Microsoft services. Immediate Threat: Microsoft Exchange and Azure Details on vulnerabilities CVE-2026-56191 and CVE-2026-58275 and their implications. The Impact on UK SMBs Exploration of how these vulnerabilities affect small to medium UK businesses. Proven Methods for Protection Advice on patching systems, MFA implementation, and access control. CTA Encouragement to follow the podcast and engage with content. Why This is a Competitive Advantage How addressing vulnerabilities enhances business reputation. How to Talk to Your Board Tips for discussing cybersecurity issues with board members. What to Do Next Next steps for businesses, including system reviews and staff training. Outro Corrine wraps up by emphasising cybersecurity as a resilience strategy. Links https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56191 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-58275 https://www.microsoft.com/en-us/security
Cybersecurity Threats Facing UK Businesses In this episode of The Daily CVE Update, Corrine Jefferson highlights critical vulnerabilities affecting UK small businesses. The spotlight falls on urgent threats, including a severe Microsoft SharePoint exploit (CVE-2026-50522) that demands immediate mitigation, as cybercriminals actively target this weakness. Oracle Fusion Middleware also presents a significant risk with CVE-2026-60366, which must be patched to prevent catastrophic intrusions. Additionally, Adobe Acrobat’s vulnerability (CVE-2026-48294) through its Chrome extension could jeopardise your WhatsApp Web communications. Corrine stresses the importance of not ignoring these threats, advising prompt updates, thorough risk assessments, and robust employee training to safeguard business operations. Key points for decision-makers include addressing reputational damage, compliance issues, and the cost-effectiveness of proactive cybersecurity measures to ensure business continuity. Chapters Intro Corrine introduces the episode, highlighting the critical cybersecurity threats facing UK small businesses. Urgent Threat: Microsoft SharePoint Exploit Discussion on the serious CVE-2026-50522 vulnerability in Microsoft SharePoint, stressing immediate action and mitigation. CTA Encouragement to follow the show, leave ratings, and share valuable insights with others. Oracle Fusion Middleware: A Gateway for Intruders Examination of CVE-2026-60366 in Oracle Fusion Middleware, with advice on urgent updating to prevent major intrusions. Adobe Acrobat Extension: Impact on Web and WhatsApp Insight into CVE-2026-48294 affecting Adobe Acrobat’s Chrome extension, emphasizing the critical need for updates. How to Not Be a Statistic Steps for immediate action: patching systems, conducting vulnerability assessments, and training employees. Board-Level Arguments Crucial discussion points for decision-makers on handling cybersecurity risks and ensuring business continuity. Outro Closing remarks and motivation for immediate action to tackle cybersecurity threats. Links https://www.microsoft.com/security/blog https://www.ncsc.gov.uk https://blogs.oracle.com/security https://helpx.adobe.com/security.html
Protecting Your Business from WordPress and Oracle Threats In today’s episode of The Daily CVE Update, host Corrine Jefferson guides UK small businesses through critical vulnerabilities affecting WordPress and Oracle systems. Learn about CVE-2026-60137 and CVE-2026-63030, which are currently being exploited in the wild, allowing attackers to execute remote code on WordPress sites. With WordPress powering a large percentage of websites, the risk of attack is significant. Corrine also discusses CVE-2026-47056, a critical vulnerability in Oracle Data Integrator, allowing unauthenticated access. Discover actionable plans to safeguard your systems, including prioritising vendor updates, rooting out vulnerable plugins and themes, deploying patches, and segmenting networks. Explore how effective vulnerability management can set your business apart, and learn concrete steps such as patch management, vendor risk assessment, and team training to enhance your cybersecurity posture. Chapters Intro Introduction to WordPress and Oracle vulnerabilities impacting UK small businesses. WordPress Under Siege: SQL Injection Threat Discussion on CVE-2026-60137 and CVE-2026-63030 affecting WordPress, with guidance on securing sites. CTA Encouragement to follow and engage with the podcast. Oracle Attacks Exploiting Network Gaps Exploration of CVE-2026-47056 affecting Oracle systems and defensive strategies. From Vulnerability to Competitive Advantage Turning vulnerability management into a competitive advantage for businesses. What This Means for Your Business Actionable steps for businesses to improve their cybersecurity strategies. Outro Closing remarks emphasising the importance of addressing vulnerabilities. Links https://www.cisa.gov/news https://nvd.nist.gov
Protecting UK Businesses from Cyber Threats Corrine Jefferson presents this episode of The Daily CVE Update, offering critical insights into threats facing UK small businesses. She covers the hijacking of consumer-grade IP cameras by Russian intelligence, citing Censys data and reportings from The Hacker News. The vulnerabilities highlight how unpatched, default-configured devices can compromise security. Corrine also discusses a significant WordPress vulnerability, WP2Shell, as identified by Searchlight Cyber, which poses a severe risk for businesses relying on WordPress websites. She stresses the importance of immediate patching, underscored by alerts from the German cybersecurity agency, BSI. Finally, she examines a sophisticated phishing toolkit uncovered by Rapid7, demonstrating how attackers use AI to craft convincing phishing campaigns. Her advice includes updating staff training to counter these modern phishing tactics. Throughout the episode, Corrine emphasises proactive measures such as changing default passwords and confirming patch applications to safeguard business operations. Chapters Intro Corrine introduces the episode, highlighting the rapid pace of cyber threats and their relevance to UK small businesses. Russian Spy Cameras Are Watching Your Premises Discussion on the exploitation of consumer-grade IP cameras by Russian intelligence. Highlights vulnerabilities from 2016 still being targeted. CTA Encourages listeners to rate the show and share it with someone who might benefit from the information. WordPress WP2Shell Pre-Auth Remote Code Execution Details a critical WordPress vulnerability that allows remote code execution without authentication and outlines necessary responses. AI Phishing Toolkit Exposed Examines an advanced phishing toolkit using AI, which produces sophisticated and convincing phishing campaigns. Outro Reiterates the importance of auditing camera security, patching WordPress, and updating phishing guidance. Links https://thehackernews.com/2023/07/russian-intelligence-cameras.html https://censys.io/reports/ip-cameras-exposed https://w3techs.com/technologies/overview/content_management https://www.bsi.bund.de/EN/Home/home_node.html https://www.searchlightcyber.com/blog/wp2shell-vulnerability-analysis https://www.rapid7.com/research/reports/phishing-toolkit-exposure
SonicWall Zero-Day and NGINX Critical Flaw: What UK Businesses Must Do Now This episode examines two critical vulnerabilities disclosed this week that affect UK small business infrastructure. CVE-2026-15410 and CVE-2026-15409 in SonicWall SMA 1000 VPN appliances were exploited as zero-days before patches existed, allowing attackers root access, credential harvesting, and persistent malware deployment. CVE-2026-42533 in NGINX web servers enables unauthenticated attackers to crash services or potentially execute remote code. Both vulnerabilities target internet-facing infrastructure commonly managed by third parties, creating blind spots for business owners. Corrine explains the technical details, business implications under UK GDPR and Cyber Essentials frameworks, and provides five specific actions to take before week’s end: identifying internet-facing devices, confirming patch status for both vulnerabilities, reviewing authentication logs, and establishing documented patching SLAs with managed service providers. The episode emphasises that perimeter compromises become credential compromises, requiring password resets beyond device patching, and that regulatory expectations for timely patching of disclosed vulnerabilities are explicit and auditable. Chapters Introduction Corrine introduces two critical vulnerabilities affecting UK small businesses, emphasising factual analysis over alarming language and focusing on actionable responses to situations where attackers exploited flaws before patches existed. SonicWall SMA 1000: Exploited Before the Patch Existed Analysis of CVE-2026-15410 and CVE-2026-15409 in SonicWall VPN appliances, exploited as chained zero-days by threat actor UTA0533. Covers root access outcomes, LDAP credential harvesting, persistent malware, and the requirement for password resets beyond device patching. Call to Action Brief request for listeners to follow, rate, review, and share the show with other small business owners who need clearer cybersecurity information. NGINX: A Critical Flaw That Can Crash Your Web Server Examination of CVE-2026-42533 in NGINX web servers, a heap buffer overflow enabling unauthenticated attackers to crash services or potentially achieve remote code execution. Addresses the common scenario where businesses don’t directly manage web infrastructure. The Pattern Both Stories Share Identifies the common characteristics that make both SonicWall and NGINX attractive targets: internet accessibility and elevated privileges. Discusses the inadequacy of set-and-forget infrastructure management for perimeter devices. The Business Case and Competitive Edge Commercial justification for prioritising patches, covering Cyber Essentials certification requirements, UK GDPR obligations under ICO guidance, client procurement expectations, and the regulatory exposure from unpatched disclosed vulnerabilities. What to Do Before the End of This Week Five specific actions in priority order: identify internet-facing devices, confirm SonicWall patch status, confirm NGINX patch status, review authentication logs on affected devices, and establish documented patching SLAs with managed service providers. Closing Thoughts Final emphasis that effective security comes from knowing what infrastructure you run, who manages it, and having enforceable expectations for critical vulnerability response, not from large budgets. Links https://www.volexity.com/blog/2026/07/sonicwall-sma-1000-zero-day-exploitation/ https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0015 https://www.f5.com/company/blog/security/nginx-vulnerability-cve-2026-42533 https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/security/ https://www.ncsc.gov.uk/cyberessentials/overview
Three Critical Unauthenticated Flaws: SharePoint, Zoom, and WireGuard Easy On 16 July 2026, CISA confirmed active exploitation of CVE-2026-58644, a critical deserialization vulnerability in Microsoft SharePoint that requires no authentication. The same day brought two additional severe vulnerabilities: CVE-2026-53412 in Zoom Workplace for Windows (CVSS 9.8) enabling account takeover, and CVE-2026-63089 in WireGuard Easy (CVSS 9.3) exposing VPN credentials through a trivially exploitable token generation flaw. All three vulnerabilities share a dangerous pattern: they require no credentials, are accessible over a network, and affect tools widely deployed across UK small businesses. This episode provides technical context for each vulnerability, explains the exploitation mechanisms, and delivers explicit remediation steps. Corrine walks through exactly what business owners and IT managers must do before close of business today, including patch application, credential revocation, and documentation practices that matter when facing ICO inquiries or client security questionnaires. This is not theoretical risk assessment; this is active threat response. Chapters Introduction Corrine introduces three critical vulnerabilities disclosed within 24 hours, all affecting commonly used business tools and requiring no authentication to exploit. One is confirmed as actively exploited in the wild. SharePoint Actively Exploited: CVE-2026-58644 CISA added CVE-2026-58644 to the Known Exploited Vulnerabilities catalogue on 16 July 2026. This deserialization flaw in Microsoft SharePoint allows unauthenticated remote code execution. The vulnerability affects SharePoint Online and on-premises installations, with immediate patching required. Call to Action Corrine encourages listeners to follow the podcast, leave reviews, and share the episode with business owners and IT managers who need this intelligence. Zoom Account Takeover: CVE-2026-53412 CVE-2026-53412 (CVSS 9.8) affects Zoom Workplace for Windows and the VDI client. An input validation failure allows unauthenticated attackers with network access to take over user accounts, exposing meeting recordings, chat histories, and contact data. WireGuard Easy Credential Theft: CVE-2026-63089 CVE-2026-63089 (CVSS 9.3) affects WireGuard Easy through version 15.3.0. A fundamentally broken token generation mechanism using CRC32 over a 1,000-value keyspace allows trivial credential theft. Patching requires updating to commit 66b292b and revoking all previously issued credentials. The Pattern Worth Noting All three vulnerabilities share critical characteristics: unauthenticated access, network accessibility, and presence in widely deployed business tools. The pattern reflects attacker targeting strategy focused on volume and accessibility. What to Do Before End of Day Concrete remediation steps: patch SharePoint immediately, update Zoom on all Windows devices, update and credential-revoke for WireGuard Easy, confirm patching with IT providers in writing, and document all actions for compliance and client security questionnaires. Closing Corrine summarises the day’s vulnerabilities and remediation requirements. Patches exist for all three flaws; the only variable is whether organisations apply them promptly. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://nvd.nist.gov/vuln/detail/CVE-2026-58644 https://nvd.nist.gov/vuln/detail/CVE-2026-53412 https://nvd.nist.gov/vuln/detail/CVE-2026-63089
570 Patches, a Zero-Day Exploit, and the Building System No One Thought About Microsoft released 570 patches on Patch Tuesday, but hours later a working exploit arrived for a Windows flaw the updates don’t fully close. CISA confirmed active exploitation of a building automation protocol used in UK commercial premises, where attackers can lock climate control, lighting, and access systems. Firefox shipped two critical remote code execution vulnerabilities with public exploit code already in circulation. For small businesses, the gap between patch release and deployment creates a measurable, exploitable window. This episode breaks down what actually happened this week, what the technical jargon means in practice, and which actions you can take today before the next wave begins. Speed is the variable that determines whether this week’s vulnerabilities become next week’s breach. Chapters Intro Microsoft released 570 patches on Patch Tuesday. Hours later, a working exploit arrived. CISA confirmed active exploitation of a building automation protocol. Firefox shipped two critical flaws with public exploit code. This is a normal Tuesday now. 570 Microsoft Patches and a Zero-Day That Arrived Anyway Microsoft’s 570 patches create an operational deficit for businesses running monthly patching cycles. A researcher published LegacyHive, a privilege escalation exploit for a Windows flaw the July patches don’t fully close. Attackers chain vulnerabilities together. The public exploit has limitations; private versions likely do not. Critical patches need applying this week, not at month-end. Cyber Essentials sets a fourteen-day threshold for critical vulnerabilities. CTA Follow the show, leave a rating, and share with other small business owners who need this briefing. CISA Confirms Active Exploitation of a Building Automation Protocol CISA added CVE-2023-4346 to its Known Exploited Vulnerabilities catalogue. The vulnerability affects KNX building automation systems controlling heating, lighting, access, and climate control in UK commercial premises. Attackers can purge devices and lock them with a BCU key, requiring physical intervention on each unit. Many small businesses occupy premises with KNX systems they don’t know exist. Ask your building manager or landlord whether KNX is in use and reference CISA’s guidance. Firefox Has Two Critical Flaws With Exploit Code Already Public Mozilla issued an emergency update for Firefox addressing CVE-2026-15718 and CVE-2026-15719, both critical remote code execution vulnerabilities with public exploit code. Attack vector requires visiting a malicious or compromised website. Mozilla is not yet aware of active exploitation, but the gap between public exploit code and weaponisation is typically hours. Update Firefox to version 152.0.6 today via Help, then About Firefox. Why the Patching Backlog Problem Is Getting Worse Seven hundred fixes across major vendors in a single week. AI-assisted vulnerability discovery is accelerating the rate at which flaws are identified. For small businesses relying on monthly MSP support, the maths creates a permanent gap between patch release and deployment. Attackers target this window. The CISA Known Exploited Vulnerabilities catalogue helps triage which patches matter most. Check it weekly at cisa.gov/known-exploited-vulnerabilities-catalog. Outro Speed determines whether today’s news becomes your problem. Patch lag is a measurable, exploitable window. Update Firefox today. Ask your IT support when July Windows updates are being deployed. Ask your building manager whether the premises uses KNX. Three questions, this week, before Friday. Links https://cisa.gov/known-exploited-vulnerabilities-catalog
622 Microsoft Patches, Four Active Exploits, and Your Supply Chain Risk On 14 July 2026, Microsoft released 622 vulnerabilities in a single Patch Tuesday, the largest in company history. Buried within that release are two zero-day vulnerabilities actively exploited in the wild: CVE-2026-56164 (SharePoint Server privilege escalation) and CVE-2026-56155 (AD FS local privilege escalation), both confirmed by CISA’s Known Exploited Vulnerabilities catalogue. Two additional critical Remote Desktop Protocol vulnerabilities (CVE-2026-54990 and CVE-2026-56190) allow unauthenticated remote code execution with CVSS scores of 9.8. Running concurrently, two SonicWall SMA1000 vulnerabilities (CVE-2026-15409 and CVE-2026-15410) form a complete attack chain from unauthenticated access to operating system command execution. This episode examines what these vulnerabilities mean for UK small businesses, particularly those in supply chain relationships with larger clients, and provides actionable guidance on patch prioritisation, RDP security, MSP accountability, and Cyber Essentials compliance requirements. Chapters Intro Microsoft patches 622 vulnerabilities in a single day, including two actively exploited zero-days confirmed by CISA. This episode covers immediate threats, supply chain implications, and what UK small businesses must do today. Microsoft’s Record 622-Flaw Patch Tuesday Context on the unprecedented volume of patches released 14 July 2026, the operational challenge of patch fatigue, and why CISA’s Known Exploited Vulnerabilities catalogue remains the clearest signal for prioritisation. The Two SharePoint and AD FS Zero-Days Detailed examination of CVE-2026-56164 (SharePoint Server unauthenticated privilege escalation) and CVE-2026-56155 (AD FS local privilege escalation), both CISA KEV-listed on patch day with confirmed active exploitation. CTA Request to follow, rate, review, and share the show with other UK small business owners. The Critical RDP Vulnerabilities Analysis of CVE-2026-54990 and CVE-2026-56190, two separate CVSS 9.8 heap-based buffer overflow vulnerabilities in Windows Remote Desktop Client and RDP, both allowing unauthenticated remote code execution. The SonicWall Attack Chain Two SonicWall SMA1000 vulnerabilities (CVE-2026-15409 server-side request forgery and CVE-2026-15410 code injection) form a complete two-step attack chain from unauthenticated access to OS command execution, both CISA KEV-listed. Supply Chain Risk and Patching as a Contractual Obligation How this week’s vulnerability combination creates supply chain risk for small businesses serving larger clients, and why security posture is increasingly a contractual and commercial requirement. Why Patching Is a Competitive Signal Cyber Essentials requirements for patching high and critical vulnerabilities within 14 days, and how documented patch management processes differentiate businesses in UK public sector procurement. What to Do Today Five concrete actions: obtain written patch confirmation from MSPs, audit RDP exposure, verify SonicWall remediation, review service level agreements, and document all communications for GDPR technical controls evidence. Outro Closing summary emphasising that whilst 622 patches sounds overwhelming, the priority list is clear: two actively exploited zero-days, two critical RDP vulnerabilities, and four SonicWall CVEs forming a working attack chain. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://nvd.nist.gov/ https://thehackernews.com/ https://arstechnica.com/ https://www.ncsc.gov.uk/cyberessentials/overview
Active Exploitation of Two Joomla Extensions and Emerging Ransomware Automation CISA has confirmed active exploitation of two Joomla extensions, iCagenda and Balbooa Forms, both vulnerable to unauthenticated PHP code execution. The vulnerabilities, tracked as CVE-2026-48939 and CVE-2026-56291, allow attackers to run code without credentials, creating immediate legal and operational risks for UK small businesses running Joomla websites. Australia’s cybersecurity agency flagged these as part of a coordinated campaign targeting CMS platforms. For businesses holding customer data, this represents a potential GDPR personal data breach with mandatory ICO notification requirements within 72 hours of awareness. Meanwhile, emerging threat intelligence describes JADEPUFFER, a ransomware strain reportedly using AI agents to automate reconnaissance, target selection, and extortion communication. While confidence in JADEPUFFER intelligence remains moderate, it illustrates a concerning directional shift: ransomware operations becoming increasingly automated and economical to deploy against smaller targets previously considered too labour-intensive to attack. This episode provides actionable guidance for checking Joomla installations, reviewing hosting logs, engaging web agencies with specific questions, understanding GDPR breach notification obligations, and subscribing to the NCSC Early Warning Service. Chapters Intro Corrine introduces the episode and flags confirmed active exploitation of two Joomla extensions as the lead story requiring immediate attention from UK small businesses. Joomla Under Active Attack CISA has added two Joomla extensions to its Known Exploited Vulnerabilities catalogue: iCagenda (CVE-2026-48939) and Balbooa Forms (CVE-2026-56291). Both allow unauthenticated PHP code execution, meaning attackers require no credentials. Australia’s cybersecurity agency flagged a coordinated CMS exploitation campaign. Joomla powers over one percent of all websites globally, and automated scanners probe indiscriminately. Successful exploitation enables data exfiltration, persistent backdoors, lateral movement, or ransomware deployment. For sites collecting customer data, this constitutes a potential GDPR personal data breach requiring ICO notification within 72 hours of awareness. CTA Corrine requests audience support through follows, ratings, reviews, and sharing with other small business owners. JADEPUFFER: AI-Powered Ransomware Threat intelligence reports describe JADEPUFFER, a ransomware strain allegedly using AI agents to automate reconnaissance, target selection, and extortion communication. Confidence in this intelligence is moderate and should not drive panic or unvetted procurement. The significance lies in the directional shift: ransomware automation reduces manual effort, making small businesses economically viable targets at scale. Historical economics favoured high-value targets; automation changes that calculation by enabling attackers to process thousands of smaller targets simultaneously for aggregate returns. What Small Businesses Should Do Now Immediate actions include checking Joomla installations for iCagenda and Balbooa Forms, updating or removing them today, reviewing hosting logs for anomalous activity over the past 30 days, contacting web agencies with specific questions about CVE-2026-48939 and CVE-2026-56291 patching, understanding GDPR breach notification obligations before an incident occurs, and subscribing to the NCSC Early Warning Service. These actions align with Cyber Essentials Plus patch management requirements and provide audit-ready control evidence. Outro Corrine emphasises the urgency of addressing the Joomla vulnerabilities today, acknowledges JADEPUFFER as worth monitoring without immediate action beyond fundamentals, and reinforces the 20-minute practical task of checking and patching Joomla extensions. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/section/keep-up-to-date/threat-reports https://ico.org.uk/for-organisations/report-a-breach/ https://www.ncsc.gov.uk/cyberessentials/overview
Two Critical Vulnerabilities Demand Action Before Friday On 10 July 2026, two critical vulnerabilities require immediate attention from UK small businesses. CVE-2026-58123, affecting Hermes WebUI, scores 9.8 on the CVSS scale and permits unauthenticated remote code execution through four HTTP requests with no credentials required. CVE-2026-58122, rated 9.1, allows attackers to bypass local-origin protections and conduct server-side request forgery. Microsoft patched CVE-2026-50656 (RoguePlanet), a Windows Defender elevation-of-privilege flaw with publicly available exploit code since 10 June, but the patch may cause disk space exhaustion on affected machines. This episode examines why security and infrastructure tools have become primary attack vectors, analyses the 30-day window between exploit publication and patch availability, and provides five specific actions to complete before the end of the week. Host Corrine Jefferson explains how documented vulnerability response creates competitive advantage in procurement conversations and demonstrates security posture to clients with supply chain requirements. Chapters Intro Two critical vulnerabilities published this week demand action before Friday. One permits unauthenticated remote code execution, the other patches a serious Windows flaw but may silently fill hard drives. Hermes WebUI: A 9.8-Rated Hole With No Lock on the Door CVE-2026-58123 and CVE-2026-58122 affect Hermes WebUI, an open-source interface for running large language models locally. The first vulnerability, rated 9.8, allows unauthenticated remote code execution through four HTTP requests. The second, rated 9.1, bypasses local-origin restrictions and enables server-side request forgery, API key theft, and persistent token generation. CTA Follow the show, leave a rating or review, and share with other small business owners. Windows Defender: The Patch That Might Break Your Machine While Fixing It Microsoft patched CVE-2026-50656 (RoguePlanet), a Windows Defender elevation-of-privilege vulnerability with publicly available exploit code since 10 June. The patch may cause disk space exhaustion on affected machines. Businesses must apply the update and then check disk utilisation on every Windows endpoint. The Pattern: Security Tools Are the Target Both vulnerabilities involve security and infrastructure tooling rather than business applications. Attackers target tools with elevated access and trusted network positions. Security tools require the same scrutiny as any other networked component. Why This Gives You an Edge Most UK small businesses do not track vulnerability disclosures or correlate patches with potential incidents. Demonstrating documented vulnerability response creates competitive advantage in procurement conversations, particularly with clients requiring supply chain security evidence. What To Do Before Friday Five specific actions: check for Hermes WebUI and update to version 0.51.788 or take offline; apply Windows Defender update; check disk space after patching; obtain written MSP confirmation; document all response actions for future evidence requirements. Outro Tools with the highest access levels are increasingly targeted first. Patch Hermes WebUI, apply the Defender update, check disk space, obtain MSP confirmation, and document actions taken. Links https://nvd.nist.gov/vuln/detail/CVE-2026-58123 https://nvd.nist.gov/vuln/detail/CVE-2026-58122 https://nvd.nist.gov/vuln/detail/CVE-2026-50656 https://arstechnica.com/security/2026/07/microsoft-defender-patch-disk-space/ https://www.huntress.com/blog/dragonforce-ransomware-citrix-netscaler
Critical WordPress Plugin Flaw and Microsoft Dynamics 365 Vulnerability Two critical vulnerabilities have been published in the last 24 hours, both requiring immediate attention from UK small businesses. CVE-2026-58480 affects Blocksy Companion Pro, a widely deployed WordPress plugin, scoring 9.8 on the CVSS severity scale. The flaw allows unauthenticated remote code execution through inadequate file upload validation, enabling attackers to upload and execute malicious PHP files by exploiting a substring matching error in the plugin’s validation logic. CVE-2026-47646 targets Microsoft Dynamics 365 Customer Voice with a CVSS score of 9.3, enabling unauthenticated cross-site scripting attacks that facilitate spoofing of legitimate business communications. This week, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalogue, including two Joomla plugin flaws with maximum CVSS scores of 10.0, both involving identical file upload validation failures. The pattern is clear: CMS plugins with inadequate upload validation are being systematically targeted through automated scanning. Small businesses must verify that Blocksy Companion Pro has been updated to version 2.1.47 immediately, confirm their web providers have documented patch management processes, and ensure Microsoft 365 automatic updates are enabled. The gap between vulnerability publication and active exploitation is now measured in hours, making same-day patching essential for maintaining security posture and meeting Cyber Essentials certification requirements. Chapters Introduction Corrine introduces two critical vulnerabilities published in the last 24 hours: a 9.8 severity WordPress plugin flaw and a 9.3 Microsoft survey tool vulnerability, both exploitable without authentication. CVE-2026-58480: WordPress Plugin With a 9.8 Score Detailed analysis of the Blocksy Companion Pro vulnerability allowing unauthenticated remote code execution through inadequate file upload validation. The plugin’s use of substring matching instead of proper extension checking enables attackers to upload malicious PHP files disguised with .woff2 in the filename. Call to Action Brief request for listeners to follow the show, leave ratings, and share the episode with others managing WordPress sites or small businesses. CVE-2026-47646: Microsoft Dynamics 365 Customer Voice Examination of the cross-site scripting vulnerability in Microsoft Dynamics 365 Customer Voice that enables spoofing attacks, allowing attackers to craft malicious content appearing to originate from legitimate business survey infrastructure. The Pattern Behind This Week’s Alerts Analysis of CISA’s addition of four vulnerabilities to its Known Exploited Vulnerabilities catalogue, including two Joomla plugin flaws with 10.0 CVSS scores, highlighting the systematic targeting of CMS plugins with inadequate file upload validation. Why Your MSP’s Answer Matters Discussion of the importance of verifying that web providers have documented patch management processes and service levels, with specific guidance on questions to ask regarding the Blocksy vulnerability and Cyber Essentials certification requirements. Making the Business Case Three arguments for prioritising patch management: the zero cost of patching versus breach response costs, the public exposure of websites as attack surfaces, and the regulatory expectations around known-exploited vulnerabilities. What to Do Before the End of Today Five concrete actions: verify Blocksy Companion Pro version, review all plugin updates, contact web providers in writing, enable Microsoft 365 automatic updates, and review file upload validation logic. Closing Final emphasis that the gap between vulnerability publication and exploitation is measured in hours, making same-day patching essential for critical severity vulnerabilities. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog
ColdFusion and SimpleHelp: Two-Hour Exploitation Timelines Two critical vulnerabilities are under active exploitation right now, with direct implications for UK small businesses. Adobe ColdFusion CVE-2026-48282 carries a perfect CVSS 10.0 score and was weaponised within two hours of public disclosure. The vulnerability allows unauthenticated remote code execution on affected servers. Meanwhile, SimpleHelp RMM CVE-2026-48558 enables attackers to create Technician accounts on unpatched servers, granting access to every client system managed through that infrastructure. Hundreds of vulnerable SimpleHelp servers remain exposed worldwide weeks after patches became available. Both vulnerabilities highlight a structural problem: attackers now operate at machine speed whilst defenders, particularly in under-resourced environments, operate at human speed. Monthly patch cycles are structurally inadequate when exploitation timelines are measured in hours. This episode provides three specific, answerable questions to ask your IT provider before the end of the week, with guidance on why written responses matter for cyber insurance and due diligence. The NCSC’s vulnerability management and supply chain security guidance is referenced throughout. Your MSP’s patch status is your risk, not theirs. Chapters Introduction: The Two-Hour Weaponisation Window Corrine introduces two critical vulnerabilities currently under active exploitation. A CVSS 10.0 Adobe ColdFusion flaw was weaponised within two hours of disclosure, and a SimpleHelp RMM vulnerability affects MSP tooling. Both have direct consequences for UK small businesses, even for those unaware they use the affected software. Adobe ColdFusion CVE-2026-48282: A Perfect Ten for the Wrong Reasons Analysis of CVE-2026-48282, a path traversal vulnerability allowing unauthenticated remote code execution on Adobe ColdFusion servers. Adobe issued patches on 30 June 2026. The Canadian Centre for Cyber Security confirmed active exploitation, with weaponisation occurring within two hours of disclosure. Monthly patch cycles are structurally inadequate for such rapid exploitation timelines. Call to Action Listener engagement request: follow the show, leave ratings and reviews, and share with those responsible for IT contracts. SimpleHelp RMM CVE-2026-48558: Your MSP’s Tooling as the Attack Vector Examination of CVE-2026-48558, which allows unauthenticated creation of Technician accounts on vulnerable SimpleHelp servers. The Shadowserver Foundation identified hundreds of unpatched servers worldwide. A compromised RMM server grants attackers simultaneous access to all client systems managed through that MSP’s infrastructure. The Exploitation Timeline and What It Tells Us Both vulnerabilities demonstrate the structural asymmetry between machine-speed attacks and human-speed defence. The NCSC’s vulnerability management and supply chain security guidance addresses these risks explicitly. IT providers require documented emergency patch procedures for critical vulnerabilities with active exploitation, not monthly cycles. Conclusion: Three Questions for Your IT Provider Three specific questions to ask your IT provider before week’s end: SimpleHelp patch status, ColdFusion patch status, and emergency patch procedures. Written answers create audit trails useful for cyber insurance renewals and client due diligence. Asking the question provides material advantage over those who do not. Links https://www.adobe.com/security/adobe-coldfusion-security-updates.html https://www.cyber.gc.ca/en/alerts-advisories https://www.shadowserver.org/ https://www.ncsc.gov.uk/collection/vulnerability-management https://www.ncsc.gov.uk/collection/supply-chain-security
SharePoint Under Active Attack, AI Ransomware, and FortiBleed CISA has confirmed active exploitation of CVE-2026-45659, a remote code execution vulnerability in Microsoft SharePoint Server. UK small businesses running on-premises SharePoint need to verify patch status immediately, not when convenient. This episode examines the gap between Microsoft’s May patch release and delayed security bulletin, explains why basic site members can exploit this flaw to gain server control, and clarifies the distinction between cloud-hosted and on-premises risk. We also cover JADEPUFFER, the first documented ransomware attack conducted entirely by an AI agent without human operators, and FortiBleed, a credential theft campaign targeting Fortinet devices that fed directly into INC and Lynx ransomware operations. The common thread: automated attack pipelines are eliminating the economic barriers that previously made small businesses lower-priority targets. Corrine provides five specific actions to complete before the end of the week, including how to verify your SharePoint patch status, check AI development tool exposure, confirm Fortinet firmware versions, test offline backups, and request patch reports from your MSP. Chapters Introduction Corrine introduces three active threat stories: CISA-confirmed SharePoint exploitation, AI-automated ransomware, and credential theft feeding ransomware pipelines. None are theoretical. SharePoint Under Active Attack: CVE-2026-45659 CISA added CVE-2026-45659 to its Known Exploited Vulnerabilities catalogue on 1 July 2026, confirming active exploitation of a SharePoint Server remote code execution flaw. The vulnerability allows basic site members to execute arbitrary code through deserialisation of untrusted data. Microsoft patched in May but delayed the security bulletin by weeks, creating a window where IT teams had no visibility. On-premises SharePoint deployments require manual patching; cloud-hosted SharePoint Online is managed by Microsoft. UK businesses must confirm patch status today with their MSP or IT provider. Call to Action Corrine asks listeners to follow the show, leave reviews, and share the episode with small business owners and IT providers. AI-Automated Ransomware: JADEPUFFER Sysdig documented the first ransomware attack conducted entirely by an AI agent without human operators, tracked as JADEPUFFER. Initial access exploited CVE-2025-3248 in Langflow, an open-source AI development tool. The AI handled credential theft, lateral movement, encryption, and database wiping autonomously. This removes the human operator time bottleneck that previously made small businesses less attractive targets. Offline backups, disconnected from the network, become essential as automated attacks compress detection windows. FortiBleed: Credential Theft Feeding Ransomware Pipelines SOCRadar linked the FortiBleed campaign to INC and Lynx ransomware operations. The campaign exploited Fortinet FortiGate devices, resulting in 354 confirmed intrusions and at least 12 ransomware deployments. Stolen credentials moved quickly from compromise to ransomware use. UK businesses using Fortinet equipment must verify current firmware versions with their MSP or IT provider. Conclusion and Action Steps Corrine provides five specific actions to complete before Friday: confirm SharePoint patch status for CVE-2026-45659, check AI development tool internet exposure, verify Fortinet firmware versions, test offline backup restoration, and request written patch reports from MSPs. Businesses that ask the right questions of IT providers navigate threats more effectively than those relying solely on budget. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://sysdig.com/blog/jadepuffer-ai-ransomware/ https://socradar.io/fortibleed-credential-theft-campaign-linked-to-inc-and-lynx-ransomware/
SharePoint Exploit, Passwordless Cameras, and AI Ransomware via Browser CISA added Microsoft SharePoint Server to its Known Exploited Vulnerabilities catalogue on 1 July 2026, confirming active exploitation of CVE-2026-45659. This deserialization flaw allows authenticated attackers to run arbitrary code on vulnerable servers. UK small businesses running on-premises or hybrid SharePoint deployments must verify patch status immediately. Meanwhile, the NIST NVD revealed hardcoded credentials in JAIOTlink C492A-W6 IP cameras and unauthenticated command injection in Shenzhen Aitemi M300 Wi-Fi repeaters, exposing cheap networked devices as unlocked entry points. Finally, researchers demonstrated AI-generated ransomware that exploits the Chromium File System Access API to encrypt files through browser permissions users have already granted. Google released Chrome 150, patching 382 vulnerabilities including 15 critical flaws. This episode explains why browser patching, device inventories, and permission audits are now procurement-level requirements, not IT housekeeping. Corrine delivers actionable guidance: demand specific CVE remediation timelines from your MSP, catalogue every networked device, revoke unnecessary browser permissions, and review cyber insurance coverage for browser-based attack vectors. Chapters Intro Corrine introduces the three critical threats facing UK small businesses today: active SharePoint exploitation confirmed by CISA, passwordless IP cameras on business networks, and AI-generated ransomware abusing browser permissions. SharePoint Is Being Actively Exploited CVE-2026-45659, a deserialization flaw in Microsoft SharePoint Server, allows authenticated attackers to execute arbitrary code. CISA’s KEV listing confirms real-world exploitation. On-premises and hybrid SharePoint deployments require immediate patch verification, not general IT enquiries. CTA Corrine invites listeners to follow, rate, review, and share the show with small business owners who need practical security intelligence. Your Office Camera May Have No Password CVE-2026-58453 exposes hardcoded credentials in JAIOTlink C492A-W6 cameras, allowing unauthenticated access to live feeds and command injection. CVE-2026-58457 affects Aitemi M300 repeaters with root-level command injection. Cheap commodity devices become staging points for lateral movement. AI-Generated Ransomware Is Using Your Browser Against You Researchers identified AI-generated malware exploiting the Chromium File System Access API to encrypt files via browser permissions. Google Chrome 150 patches 382 vulnerabilities. Browser patching and permission audits are now critical attack surface controls. Why This Matters for Your Competitive Position Timely patching, device inventories, and permission controls are becoming procurement requirements. Demonstrable security controls differentiate suppliers in contracts with clients who enforce supply chain security standards. Outro Corrine recaps the three action points: verify SharePoint patch status for CVE-2026-45659, inventory and secure networked devices, and apply Chrome 150 while auditing file system permissions. Cyber insurance policies may not cover browser-based ransomware delivery. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://nvd.nist.gov/vuln/detail/CVE-2026-45659 https://nvd.nist.gov/vuln/detail/CVE-2026-58453 https://nvd.nist.gov/vuln/detail/CVE-2026-58457 https://www.ncsc.gov.uk/collection/vulnerability-management
CVE-2026-48558: The RMM Vulnerability Putting Every MSP Client at Risk On 29 June 2026, CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalogue. This CVSS 10.0 authentication bypass flaw in SimpleHelp, a widely deployed remote monitoring and management platform, allows attackers to create privileged technician accounts without credentials. Active exploitation campaigns have already deployed TaskWeaver persistent access malware and Djinn Stealer credential harvesting tools through compromised RMM servers. For UK small businesses, the risk is direct: if your managed service provider uses an unpatched SimpleHelp instance, every system they manage is exposed through a single vulnerability. This episode provides specific, actionable steps for verifying whether your MSP has patched, how to assess your exposure through shared infrastructure, and what your incident response plan should account for when the threat comes through a trusted third party. Also covered: two additional CVSS 10.0 remote code execution vulnerabilities in Adobe ColdFusion (CVE-2026-48276 and CVE-2026-48277) affecting legacy web infrastructure, and practical guidance on managing third-party IT security risk under UK GDPR data processor obligations. Chapters Intro Corrine introduces a maximum-severity, actively exploited vulnerability in SimpleHelp, the RMM software used by many managed service providers to remotely access client systems. SimpleHelp CVE-2026-48558: Your MSP’s Master Key, Stolen Detailed analysis of the CVSS 10.0 authentication bypass flaw in SimpleHelp, how it allows attackers to create privileged accounts without credentials, and the active exploitation campaigns deploying TaskWeaver and Djinn Stealer malware through compromised MSP infrastructure. CTA Request to follow, rate, review, and share the podcast. Adobe ColdFusion: Three Perfect Tens in Twenty-Four Hours Coverage of two additional CVSS 10.0 remote code execution vulnerabilities in Adobe ColdFusion (CVE-2026-48276 and CVE-2026-48277), their relevance to legacy web infrastructure, and the broader implications of multiple critical disclosures within a single day. What to Do Before the End of This Week Five specific actions for UK small businesses: contacting your MSP about CVE-2026-48558 patching status, reviewing remote access logs, checking contractual obligations, assessing incident response plans for MSP compromise scenarios, and verifying ColdFusion patch status. Outro Closing remarks emphasising the importance of third-party verification and practical oversight over trust-based security relationships. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/collection/supply-chain-security
Authentication Bypass in Remote Support Tools and libssh2 Flaw On 29 June 2026, CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalogue, confirming active exploitation of an authentication bypass in SimpleHelp remote support software. The flaw allows attackers to forge identity tokens and gain full technician access without credentials or multi-factor authentication. Because the vulnerability exists in IT providers’ infrastructure rather than client systems, UK small businesses face supply chain risk they cannot directly patch or monitor. Separately, CVE-2026-55200, a critical remote code execution vulnerability in libssh2, has a public proof-of-concept exploit available. libssh2 is embedded in numerous server administration and file transfer tools. This episode explains both vulnerabilities in practical terms and provides specific questions businesses should ask their IT providers immediately, including written confirmation of patching status, privileged access controls, and contractual notification obligations for critical security disclosures. Chapters Introduction Corrine introduces the episode’s focus on a confirmed, actively exploited vulnerability affecting remote support software used by IT providers, explaining the trust relationship businesses place in remote access tools. SimpleHelp Authentication Bypass: CVE-2026-48558 Detailed explanation of the authentication bypass vulnerability in SimpleHelp’s OIDC implementation, how it bypasses credentials and MFA, CISA’s confirmation of active exploitation, and the supply chain implications for UK small businesses relying on managed service providers. Call to Action Request for listeners to follow, rate, review and share the show. libssh2 Remote Code Execution: CVE-2026-55200 Explanation of the critical memory corruption vulnerability in libssh2 that allows malicious servers to execute code on connecting clients, the significance of the public proof-of-concept exploit, and the widespread use of libssh2 in server administration tools. Conclusion and Action Steps Five specific actions for business owners: requesting written confirmation from IT providers about SimpleHelp patching, reviewing support contracts for vulnerability notification obligations, asking about privileged access management, confirming libssh2 patching status, and setting deadlines for satisfactory responses. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://www.ncsc.gov.uk/collection/supply-chain-security
Understanding Critical CVEs: PTC and Cisco Threats Today’s episode of The Daily CVE Update, hosted by Corrine Jefferson, focuses on two critical vulnerabilities impacting UK small businesses. We delve into CVE-2026-12569 in PTC’s Windchill and FlexPLM software, which threatens product lifecycle and supply chain management by allowing unauthorised code execution. Additionally, CVE-2026-20230 targets Cisco’s Unified Communications Manager, posing a severe risk to organisational communications through remote code execution. These vulnerabilities are actively exploited, highlighting the urgency for businesses to patch systems promptly. Corrine discusses the importance of maintaining competitive advantage by being proactive in cybersecurity and provides insights on communicating these risks to board members. The episode concludes with actionable steps, including deploying necessary patches, conducting an asset review, and enhancing real-time threat monitoring. Chapters Intro Corrine introduces critical vulnerabilities affecting UK SMEs. Major Vulnerabilities at Hand Exploring CVE-2026-12569 in PTC’s software and CVE-2026-20230 in Cisco’s systems. Why This Matters Now Immediate risks of exploitation and consequences for businesses. Competitive Advantage in Knowing Proactive cybersecurity as a competitive edge. How to Sell This to Your Board Strategies for convincing board members of the importance of cybersecurity. Actionable Recommendations Specific steps for addressing current vulnerabilities. CTA Encouragement to follow, review, and share the podcast. Outro Conclusion and call to action for more secure business practices. Links https://example.com/ptc-vulnerability-2026 https://example.com/cisco-vulnerability-2026 https://example.com/cyber-threats-exploitation
Urgent Cyber Threats: WordPress and Cisco Vulnerabilities In today’s episode, Corrine highlights critical vulnerabilities affecting WordPress plugins and Cisco Unified Communications Manager. Two WordPress plugins, Invoice Generator and SignUp & SignIn, are vulnerable to attacks that could compromise admin accounts. With a CVSS score of 9.8, these flaws pose serious risks, allowing attackers to reset passwords without verification. Additionally, a Cisco flaw, actively exploited, endangers communication infrastructures by enabling file manipulation. Corrine emphasises the importance of timely updates and strong cybersecurity practices to safeguard business data and reputation. Stay informed and proactive to turn these security challenges into a competitive advantage. Chapters Intro Corrine introduces critical vulnerabilities in WordPress and Cisco impacting UK small businesses. WordPress Plugin Vulnerabilities Exploration of vulnerabilities in WordPress plugins with CVSS scores of 9.8, stressing the need for immediate updates. CTA Encouragement to follow the podcast, leave reviews, and share with others who might benefit from this information. Cisco Unified CM Flaw Highlighting the active exploitation of Cisco Unified Communications Manager, urging prompt security patching. Why This Matters Discussion on how cybercriminals target small businesses and the broader implications of unpatched systems. Competitive Advantage Turning proactive cybersecurity practices into a competitive edge for businesses. Selling Points to Your Board Key points to communicate to boards regarding risk management, cost efficiency, and reputation. Actionable Recommendations Steps for securing business systems: updates, two-factor authentication, vulnerability scans, and team communication. Outro Conclusion with a reminder to stay vigilant and address vulnerabilities promptly. Links https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12416 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12417 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-20230
Critical Vulnerabilities Threatening Small Businesses In today’s episode of The Daily CVE Update, Corrine Jefferson discusses critical cybersecurity vulnerabilities that pose significant risks to small businesses. Focusing on the Lantronix EDS5000 and Ubiquiti UniFi OS systems, Corrine explains the severe implications of code injection and improper access controls. With potential breaches leading to system takeovers, businesses must prioritise patching and security assessments. This episode underscores the importance of proactive cyber defence strategies, reputation management, and compliance to maintain trust and avoid legal pitfalls. Chapters Intro Corrine welcomes listeners and highlights the importance of cybersecurity for small businesses. Key Vulnerabilities You Can’t Ignore Details of vulnerabilities in Lantronix EDS5000 and Ubiquiti UniFi OS. Risks include code injection and improper access control. CTA Encourages listeners to follow the podcast, leave reviews, and share with others. Why This Matters for Your Business Discusses the strategic importance of addressing vulnerabilities to build trust and gain competitive advantage. Selling the Strategy to the Board Outlines the benefits of addressing vulnerabilities in terms of cost, reputation, and compliance. Actionable Recommendations Recommends patching systems, reviewing access controls, conducting assessments, and fostering security culture. Outro Emphasises staying proactive in cybersecurity. Corrine signs off with a reminder of upcoming episodes. Links https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67038 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34910 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34909 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34908 https://www.cisa.gov/
Addressing Critical CVEs: A Guide for Small Businesses In this episode of The Daily CVE Update, Corrine discusses critical vulnerabilities posing serious risks to UK small businesses. Key vulnerabilities include IBM Langflow’s CVE-2026-10561 and CVE-2026-7664, both of which require urgent attention to prevent potential breaches. The episode highlights a supply chain attack impacting ShapedPlugin WordPress Pro, where hackers have exploited update channels to execute ransomware attacks. Corrine emphasises the serious real-world consequences, such as compromised customer data, financial losses, and reputational damage. The importance of prompt updates is underscored, transforming these threats into opportunities for competitive advantage. Strategies to secure executive support are discussed, alongside actionable steps for strengthening security measures, including vendor assessments and staff training. Tune in to learn how swift action can protect and enhance your business’s security posture. Chapters Intro Introduction to the episode and discussion on the importance of addressing vulnerabilities. IBM Langflow’s Critical Flaws Details on IBM Langflow’s critical CVEs, impacting system security significantly. WordPress Plugin Supply Chain Attack Insight into the supply chain attack affecting WordPress plugins and the associated risks. Real-World Consequences Exploration of possible damages from unpatched vulnerabilities, including customer data loss. CTA Encouragement to follow, review, and share the podcast among peers. Competitive Edge Benefits of addressing vulnerabilities for gaining an edge in business security. Securing Executive Support Tips on convincing executive boards about the importance of cybersecurity. What to Do Next Actionable steps for businesses to strengthen their cybersecurity posture. Outro Conclusion with a reminder to address vulnerabilities promptly to mitigate risks. Links https://www.ibm.com/security/cve-2026-10561 https://www.ibm.com/security/cve-2026-7664 https://wordpress.org/plugins/shapedplugin
Protect Your Business: AryStinger Malware Alert In today’s episode of The Daily CVE Update, Corrine discusses the latest threat posed by AryStinger malware, which exploits vulnerabilities in outdated Realtek RTL819X routers. Small businesses in the UK are urged to take immediate action as 4300 routers are already part of this covert network. Key CVEs to watch include CVE-2026-11645 and CVE-2016-5681. This episode highlights the importance of network audits, threat intelligence, and updating cybersecurity measures to prevent business disruption, protect reputation, and maintain compliance. Corrine emphasises that updating network gear is not just risk management but a demonstration of serious commitment to security. Tune in to learn how to strengthen your cybersecurity defences and ensure third-party services meet the latest standards. Chapters Intro Overview of the critical cybersecurity insights for UK small businesses. The Wake-Up Call: AryStinger Malware’s Latest Exploit Details about AryStinger malware exploiting outdated Realtek routers. Vulnerability Exploitation: What You Need to Know Discussion on the vulnerabilities AryStinger is leveraging, including key CVEs. CTA Encouragement to follow, review, and share the podcast. Competitive Advantage: Strengthening Your Defence The importance of updating network gear and enhancing cybersecurity. Board-Level Selling Points Reasons why board members should prioritise cybersecurity updates. What This Means for Your Business Actionable steps for auditing and updating company cybersecurity measures. Closing Thoughts A call to focus on cost-prevention through updated security practices. Links https://research.qianxin.com https://www.cisa.gov/ https://cve.mitre.org/
Splunk Zero-Day, INC Ransomware, and DragonForce’s Teams Exploit CISA has confirmed active exploitation of CVE-2026-20253, a critical Splunk Enterprise vulnerability allowing unauthenticated file manipulation. Meanwhile, INC ransomware has claimed over 830 victims since 2023, exploiting unpatched Fortinet and Citrix vulnerabilities from that same year. DragonForce operators are routing command-and-control traffic through Microsoft Teams relay infrastructure, making malicious activity indistinguishable from legitimate collaboration traffic. This episode examines three distinct threats that share a common pattern: attackers are moving inside trusted infrastructure, rendering traditional perimeter defences insufficient. Corrine provides specific guidance for UK small businesses whose IT providers run Splunk, explains why unpatched CVEs from 2023 remain actively exploited, and sets out five practical actions you can take this week to verify your defences against techniques specifically designed to bypass standard firewall rules and network monitoring. Chapters Intro Corrine introduces a CISA-confirmed active exploitation of a Splunk vulnerability and previews three connected threats that challenge perimeter-based security thinking. Splunk Zero-Day: Patch It Today CVE-2026-20253 allows unauthenticated attackers to create or truncate arbitrary files in Splunk Enterprise. CISA has added it to the Known Exploited Vulnerabilities catalogue. UK businesses should verify their MSPs have patched immediately. CTA Corrine asks listeners to follow, rate, review, and share the show to extend its reach to other UK small business operators. INC Ransomware: 830 Victims and Counting INC ransomware-as-a-service has claimed over 830 victims since 2023, targeting healthcare, manufacturing, and professional services. Affiliates exploit CVE-2023-48788 and CVE-2023-3519, both disclosed in 2023 but still unpatched in many environments. DragonForce Is Hiding Inside Microsoft Teams DragonForce affiliates use Backdoor.Turn to route command-and-control traffic through Microsoft Teams relay infrastructure, bypassing standard firewall rules and network monitoring by appearing as legitimate Teams traffic. What This Pattern Actually Means Attackers are moving malicious activity inside trusted infrastructure. Perimeter-based defences cannot distinguish malicious Teams traffic from legitimate use, making endpoint detection essential alongside network controls. What to Do Before Friday Five specific actions: verify Splunk patches, check patch currency for CVEs older than 30 days, ask about endpoint detection capability, review Microsoft 365 external access settings, and stay informed. Outro Corrine summarises that the biggest active threats are hiding inside trusted tools and known vulnerabilities from 2023. Specific knowledge enables actionable conversations with IT providers. Links https://www.cisa.gov/known-exploited-vulnerabilities-catalog
