Three critical incidents with direct supply chain implications dominate today’s threat landscape. GitLab has issued an emergency warning for a maximum-severity unauthenticated remote code execution vulnerability in its CI/CD Regular Expression Compiler, requiring immediate patching. Meanwhile, Wiz Research confirms active in-the-wild exploitation of three JFrog Artifactory vulnerabilities being chained to deploy a Rust-based backdoor with full administrative access. In the retail sector, Ahold Delhaize has taken systems offline following a cybersecurity incident, with potential knock-on effects for suppliers and logistics partners across Europe and North America. All three incidents highlight a common theme: attackers are targeting developer and software management infrastructure that often sits outside standard vulnerability management programmes. UK small businesses face indirect but material risk through their IT providers, MSPs, and software suppliers. The episode examines what these incidents mean for organisations without direct control over the affected infrastructure, and how to verify patching status and supply chain exposure when you rely on third parties for critical services.