CISA has confirmed active exploitation of CVE-2026-20253, a critical Splunk Enterprise vulnerability allowing unauthenticated file manipulation. Meanwhile, INC ransomware has claimed over 830 victims since 2023, exploiting unpatched Fortinet and Citrix vulnerabilities from that same year. DragonForce operators are routing command-and-control traffic through Microsoft Teams relay infrastructure, making malicious activity indistinguishable from legitimate collaboration traffic. This episode examines three distinct threats that share a common pattern: attackers are moving inside trusted infrastructure, rendering traditional perimeter defences insufficient. Corrine provides specific guidance for UK small businesses whose IT providers run Splunk, explains why unpatched CVEs from 2023 remain actively exploited, and sets out five practical actions you can take this week to verify your defences against techniques specifically designed to bypass standard firewall rules and network monitoring.
