570 Patches, a Zero-Day Exploit, and the Building System No One Thought About

Microsoft released 570 patches on Patch Tuesday, but hours later a working exploit arrived for a Windows flaw the updates don’t fully close. CISA confirmed active exploitation of a building automation protocol used in UK commercial premises, where attackers can lock climate control, lighting, and access systems. Firefox shipped two critical remote code execution vulnerabilities with public exploit code already in circulation. For small businesses, the gap between patch release and deployment creates a measurable, exploitable window. This episode breaks down what actually happened this week, what the technical jargon means in practice, and which actions you can take today before the next wave begins. Speed is the variable that determines whether this week’s vulnerabilities become next week’s breach.

Chapters

• Intro Microsoft released 570 patches on Patch Tuesday. Hours later, a working exploit arrived. CISA confirmed active exploitation of a building automation protocol. Firefox shipped two critical flaws with public exploit code. This is a normal Tuesday now.
• 570 Microsoft Patches and a Zero-Day That Arrived Anyway Microsoft’s 570 patches create an operational deficit for businesses running monthly patching cycles. A researcher published LegacyHive, a privilege escalation exploit for a Windows flaw the July patches don’t fully close. Attackers chain vulnerabilities together. The public exploit has limitations; private versions likely do not. Critical patches need applying this week, not at month-end. Cyber Essentials sets a fourteen-day threshold for critical vulnerabilities.
• CTA Follow the show, leave a rating, and share with other small business owners who need this briefing.
• CISA Confirms Active Exploitation of a Building Automation Protocol CISA added CVE-2023-4346 to its Known Exploited Vulnerabilities catalogue. The vulnerability affects KNX building automation systems controlling heating, lighting, access, and climate control in UK commercial premises. Attackers can purge devices and lock them with a BCU key, requiring physical intervention on each unit. Many small businesses occupy premises with KNX systems they don’t know exist. Ask your building manager or landlord whether KNX is in use and reference CISA’s guidance.
• Firefox Has Two Critical Flaws With Exploit Code Already Public Mozilla issued an emergency update for Firefox addressing CVE-2026-15718 and CVE-2026-15719, both critical remote code execution vulnerabilities with public exploit code. Attack vector requires visiting a malicious or compromised website. Mozilla is not yet aware of active exploitation, but the gap between public exploit code and weaponisation is typically hours. Update Firefox to version 152.0.6 today via Help, then About Firefox.
• Why the Patching Backlog Problem Is Getting Worse Seven hundred fixes across major vendors in a single week. AI-assisted vulnerability discovery is accelerating the rate at which flaws are identified. For small businesses relying on monthly MSP support, the maths creates a permanent gap between patch release and deployment. Attackers target this window. The CISA Known Exploited Vulnerabilities catalogue helps triage which patches matter most. Check it weekly at cisa.gov/known-exploited-vulnerabilities-catalog.
• Outro Speed determines whether today’s news becomes your problem. Patch lag is a measurable, exploitable window. Update Firefox today. Ask your IT support when July Windows updates are being deployed. Ask your building manager whether the premises uses KNX. Three questions, this week, before Friday.

Links

• https://cisa.gov/known-exploited-vulnerabilities-catalog