Three critical vulnerabilities affecting network perimeter devices are under active exploitation, with attacks beginning weeks before patches became available. Ivanti Connect Secure has been targeted with a zero-day exploit chain active since early October, affecting SSL VPN gateways widely used across UK professional services, NHS supply chains, and local government. FortiMail email security appliances face confirmed exploitation of an unauthenticated remote code execution flaw allowing attackers to write arbitrary files without credentials. Over a thousand GitLab servers remain unpatched against a maximum-severity vulnerability, with Alpine Linux forced to rebuild infrastructure from scratch following attempted compromise. The common thread is products that sit at the security perimeter, often managed by third parties and updated far less frequently than endpoint devices. For UK SMBs, the operational question is not whether to patch, but whether compromise occurred during the window when no patch existed. Additional threats include C3RB3R ransomware targeting Synology NAS backup infrastructure and the TIKTOUK credential harvesting toolkit systematically extracting secrets from WordPress installations. This briefing examines why network edge appliances represent a structural vulnerability and what patch cadence changes are now operationally necessary.
