On 29 June 2026, CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalogue, confirming active exploitation of an authentication bypass in SimpleHelp remote support software. The flaw allows attackers to forge identity tokens and gain full technician access without credentials or multi-factor authentication. Because the vulnerability exists in IT providers’ infrastructure rather than client systems, UK small businesses face supply chain risk they cannot directly patch or monitor. Separately, CVE-2026-55200, a critical remote code execution vulnerability in libssh2, has a public proof-of-concept exploit available. libssh2 is embedded in numerous server administration and file transfer tools. This episode explains both vulnerabilities in practical terms and provides specific questions businesses should ask their IT providers immediately, including written confirmation of patching status, privileged access controls, and contractual notification obligations for critical security disclosures.
