Three critical vulnerabilities demand immediate attention from UK small businesses this week. CISA has confirmed active exploitation of CVE-2026-21589, affecting eight Atlassian products including Confluence and Jira, allowing unauthenticated attackers to access internal files. CVE-2026-110957 scored a perfect 10.0 CVSS rating for a Wavlink router flaw enabling complete remote compromise without authentication. Meanwhile, CVE-2026-111281 exposes Jooan security cameras shipping with permanent, unchangeable backdoor credentials. All three vulnerabilities share a critical pattern: they bypass authentication entirely, meaning multi-factor authentication offers no protection. Corrine examines what this pattern reveals about structural failures in budget hardware and enterprise software, the immediate remediation steps required for each vulnerability, and why documented patch management has become commercially valuable. The episode provides specific questions to put to IT providers in writing, explains how these vulnerabilities affect supply chain risk assessment, and outlines the evidence procurement teams increasingly require from suppliers.
