On 29 June 2026, CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalogue. This CVSS 10.0 authentication bypass flaw in SimpleHelp, a widely deployed remote monitoring and management platform, allows attackers to create privileged technician accounts without credentials. Active exploitation campaigns have already deployed TaskWeaver persistent access malware and Djinn Stealer credential harvesting tools through compromised RMM servers. For UK small businesses, the risk is direct: if your managed service provider uses an unpatched SimpleHelp instance, every system they manage is exposed through a single vulnerability. This episode provides specific, actionable steps for verifying whether your MSP has patched, how to assess your exposure through shared infrastructure, and what your incident response plan should account for when the threat comes through a trusted third party. Also covered: two additional CVSS 10.0 remote code execution vulnerabilities in Adobe ColdFusion (CVE-2026-48276 and CVE-2026-48277) affecting legacy web infrastructure, and practical guidance on managing third-party IT security risk under UK GDPR data processor obligations.