Three critical vulnerabilities are being actively exploited in the wild, all with patches available. Microsoft SQL Server’s CVE-2019-1068, a remote code execution flaw first patched in 2019, remains weaponised against unpatched systems seven years later. WordPress sites running the Avada theme and Fusion Builder plugin face a 9.8-rated vulnerability (CVE-2026-18431) allowing unauthenticated attackers to achieve full site compromise. Gitea, the self-hosted Git service, is being targeted via CVE-2026-60004, enabling arbitrary code execution through malicious Git hooks. CISA has confirmed all three as actively exploited. This episode explains the technical impact of each vulnerability, identifies the patched versions required, and sets out immediate actions for UK small businesses: verifying SQL Server patch status with IT providers, updating WordPress components to Avada 7.17 and Fusion Builder 3.17, auditing Gitea instances, and formalising patch management processes to meet Cyber Essentials requirements and avoid ICO enforcement action.
