Three critical security vulnerabilities with publicly available exploit code were disclosed on 16 August 2026, requiring immediate action from UK small businesses. This episode covers CVE-2026-19959 and CVE-2026-19961 affecting Edimax EW-7478APC routers (both scoring 9.9 on the CVSS scale), CVE-2026-16098 in the ProSolution WP Client WordPress plugin enabling unauthenticated file upload, CVE-2026-18432 in Frontend Admin by DynamiApps allowing privilege escalation to administrator level, and CVE-2026-59310, a directory traversal flaw in VMware vCenter Server. Corrine explains what each vulnerability means in practical terms, who is affected, and provides specific actions for business owners: checking router models, auditing WordPress plugins, and questioning managed service providers about vCenter patching status. The episode emphasises the distinction between theoretical vulnerabilities and those with active exploits, the importance of documented remediation actions for UK GDPR Article 32 compliance, and the supply chain risks inherent in third-party infrastructure management.
