On 14 October 2026, CISA confirmed active exploitation of two critical zero-day vulnerabilities: CVE-2026-104935 in Ivanti Connect Secure VPN and CVE-2026-96951 in Windows Shell. The Ivanti flaw allows complete authentication bypass and root-level command execution without credentials, whilst the Windows vulnerability permits command injection across the operating system. Both vulnerabilities were added to CISA’s Known Exploited Vulnerabilities catalogue, confirming they are being used in live attacks. Security firm Volexity reported attackers chaining the Ivanti flaw with two additional zero-days to achieve full system compromise and credential theft. Microsoft’s October Patch Tuesday addressed 1,413 CVEs in total, the largest single-month release on record. This episode examines the immediate risks to UK small businesses, the forensic challenges of detecting compromise, and the specific patching actions required under Cyber Essentials and GDPR frameworks. Additional critical vulnerabilities in Adobe Commerce and ColdFusion are also covered, with practical guidance for businesses running e-commerce platforms.
