Two critical vulnerabilities disclosed in the last 48 hours demand immediate attention from UK small businesses. CVE-2026-111998 affects Vanus event infrastructure with a severity score of 9.8, exploiting a hardcoded Bearer token that grants cluster-admin access to unauthenticated attackers. No password guessing or phishing required: the credential was baked into the software from deployment. Separately, Drupal’s security team has warned of two remote code execution vulnerabilities affecting all supported versions, with exploits expected within hours or days of disclosure. Both vendors have issued patches. The gap between disclosure and exploitation continues to shrink, and automated scanning does not discriminate by company size. This episode provides operational guidance on checking your environment, contacting managed service providers, and implementing defensible patch management processes aligned with NCSC guidance and Cyber Essentials requirements. Corrine walks through the technical mechanics, the practical risks to customer data and regulatory compliance, and the documented steps you need to take today.