Three active exploitation campaigns landed on 16 September 2026, and every single one targeted vulnerabilities with available patches. Corrine walks through the WooCommerce Wholesale Lead Capture plugin flaw (CVE-2026-27540) enabling unauthenticated file uploads, the eight-second lateral movement documented in a Marimo notebook exploit (CVE-2026-39987), and the SQL injection vulnerability in Cisco Secure Email Gateway (CVE-2026-76461) now confirmed under active attack. This episode focuses on the operational gap between patch availability and patch application, which has become the primary risk vector for UK small businesses. No sophisticated tooling required, no zero-days involved, just known flaws in e-commerce platforms, development environments, and email security appliances being exploited at scale. Corrine provides specific, actionable steps for WooCommerce operators, questions to ask MSPs about network segmentation, and concrete guidance for businesses using managed email security services. The thread connecting all three stories is documented proof that the time window between initial compromise and lateral movement has collapsed to seconds, not hours, making pre-incident preparation and patch discipline the only reliable defensive posture.
