This episode examines three concurrent exploitation campaigns targeting UK small business infrastructure in August 2026. First, CVE-2026-18577 in N-able N-central RMM software, which grants unauthenticated administrative access to MSP management consoles and, by extension, every client system they control. Second, Operation CameraSwarm, a coordinated campaign that compromised over 14,530 Dahua CCTV devices using five-year-old unpatched vulnerabilities and default credentials. Third, CVE-2026-33824, a critical Windows IKE vulnerability patched in April 2026 but added to CISA’s Known Exploited Vulnerabilities catalogue in August following confirmed active exploitation. Corrine analyses the common thread: attackers are systematically targeting outsourced infrastructure that businesses stop monitoring after deployment. The episode provides specific remediation steps, including how to request patch compliance documentation from managed service providers, how to audit CCTV firmware versions, and how to verify Windows patch status against the CISA KEV catalogue. Practical guidance is given on converting threat intelligence into procurement advantages and compliance evidence for Cyber Essentials certified businesses.
