The Daily CVE Update

In this episode of The Daily CVE Update, Corrine discusses crucial vulnerabilities affecting UK small businesses, focusing on FortiOS and VeloCloud Orchestrator. FortiOS’s CVE-2025-68686 allows data breaches by bypassing earlier patches, while VeloCloud’s CVE-2026-16812 enables remote access through OS command injection. These issues threaten sensitive data and business operations, emphasising the need for immediate action. Corrine outlines steps for businesses to protect themselves, including patching systems, evaluating network exposure, monitoring for intrusions, maintaining backup systems, and conducting security audits. She also discusses how turning these challenges into opportunities can distinguish businesses as security leaders. Business owners are encouraged to view this crisis as a chance to reinforce their security posture and boost their industry credibility.

In today’s episode of The Daily CVE Update, hosted by Corrine, we explore significant cybersecurity threats facing UK small businesses. We begin with the Fastjson library vulnerability, known as CVE-2026-16723, which poses a severe risk due to its ability to allow remote code execution without a current patch. Next, we analyse the dangers of Cl0p ransomware, exploiting weaknesses in PTC Windchill and FlexPLM, specifically targeting CVE-2026-12569. The discussion offers actionable steps for businesses to protect their assets, enhance monitoring, and fortify their digital defences. Additionally, we delve into leveraging security practices as a competitive advantage and make a compelling business case for increased cybersecurity investment. With insights from reputable sources such as the National Cyber Security Centre and CISA, the episode underscores the importance of proactive measures in safeguarding against breaches that can harm reputation and financial stability.

In this episode of The Daily CVE Update, Corrine delves into critical vulnerabilities affecting Microsoft Exchange Online and Azure DNS, known as CVE-2026-56191 and CVE-2026-58275. These threats pose significant risks, allowing unauthorised attackers potential access to sensitive email content and cloud infrastructure. For UK small and medium-sized businesses, ignoring these vulnerabilities could lead to severe data breaches, financial losses, and reputational damage. Corrine offers practical advice on how businesses can protect themselves, including immediate patching, implementation of multi-factor authentication, and stringent access controls. By securing their systems, businesses not only ensure safety but also gain a competitive edge by demonstrating robust cybersecurity to clients and stakeholders. Corrine shares insights on communicating these issues effectively to boards using the language of risk and reward, and underscores the importance of compliance with regulatory requirements.

In this episode of The Daily CVE Update, Corrine Jefferson highlights critical vulnerabilities affecting UK small businesses. The spotlight falls on urgent threats, including a severe Microsoft SharePoint exploit (CVE-2026-50522) that demands immediate mitigation, as cybercriminals actively target this weakness. Oracle Fusion Middleware also presents a significant risk with CVE-2026-60366, which must be patched to prevent catastrophic intrusions. Additionally, Adobe Acrobat’s vulnerability (CVE-2026-48294) through its Chrome extension could jeopardise your WhatsApp Web communications. Corrine stresses the importance of not ignoring these threats, advising prompt updates, thorough risk assessments, and robust employee training to safeguard business operations. Key points for decision-makers include addressing reputational damage, compliance issues, and the cost-effectiveness of proactive cybersecurity measures to ensure business continuity.

In today’s episode of The Daily CVE Update, host Corrine Jefferson guides UK small businesses through critical vulnerabilities affecting WordPress and Oracle systems. Learn about CVE-2026-60137 and CVE-2026-63030, which are currently being exploited in the wild, allowing attackers to execute remote code on WordPress sites. With WordPress powering a large percentage of websites, the risk of attack is significant. Corrine also discusses CVE-2026-47056, a critical vulnerability in Oracle Data Integrator, allowing unauthenticated access. Discover actionable plans to safeguard your systems, including prioritising vendor updates, rooting out vulnerable plugins and themes, deploying patches, and segmenting networks. Explore how effective vulnerability management can set your business apart, and learn concrete steps such as patch management, vendor risk assessment, and team training to enhance your cybersecurity posture.

Corrine Jefferson presents this episode of The Daily CVE Update, offering critical insights into threats facing UK small businesses. She covers the hijacking of consumer-grade IP cameras by Russian intelligence, citing Censys data and reportings from The Hacker News. The vulnerabilities highlight how unpatched, default-configured devices can compromise security. Corrine also discusses a significant WordPress vulnerability, WP2Shell, as identified by Searchlight Cyber, which poses a severe risk for businesses relying on WordPress websites. She stresses the importance of immediate patching, underscored by alerts from the German cybersecurity agency, BSI. Finally, she examines a sophisticated phishing toolkit uncovered by Rapid7, demonstrating how attackers use AI to craft convincing phishing campaigns. Her advice includes updating staff training to counter these modern phishing tactics. Throughout the episode, Corrine emphasises proactive measures such as changing default passwords and confirming patch applications to safeguard business operations.

This episode examines two critical vulnerabilities disclosed this week that affect UK small business infrastructure. CVE-2026-15410 and CVE-2026-15409 in SonicWall SMA 1000 VPN appliances were exploited as zero-days before patches existed, allowing attackers root access, credential harvesting, and persistent malware deployment. CVE-2026-42533 in NGINX web servers enables unauthenticated attackers to crash services or potentially execute remote code. Both vulnerabilities target internet-facing infrastructure commonly managed by third parties, creating blind spots for business owners. Corrine explains the technical details, business implications under UK GDPR and Cyber Essentials frameworks, and provides five specific actions to take before week’s end: identifying internet-facing devices, confirming patch status for both vulnerabilities, reviewing authentication logs, and establishing documented patching SLAs with managed service providers. The episode emphasises that perimeter compromises become credential compromises, requiring password resets beyond device patching, and that regulatory expectations for timely patching of disclosed vulnerabilities are explicit and auditable.

On 16 July 2026, CISA confirmed active exploitation of CVE-2026-58644, a critical deserialization vulnerability in Microsoft SharePoint that requires no authentication. The same day brought two additional severe vulnerabilities: CVE-2026-53412 in Zoom Workplace for Windows (CVSS 9.8) enabling account takeover, and CVE-2026-63089 in WireGuard Easy (CVSS 9.3) exposing VPN credentials through a trivially exploitable token generation flaw. All three vulnerabilities share a dangerous pattern: they require no credentials, are accessible over a network, and affect tools widely deployed across UK small businesses. This episode provides technical context for each vulnerability, explains the exploitation mechanisms, and delivers explicit remediation steps. Corrine walks through exactly what business owners and IT managers must do before close of business today, including patch application, credential revocation, and documentation practices that matter when facing ICO inquiries or client security questionnaires. This is not theoretical risk assessment; this is active threat response.

Microsoft released 570 patches on Patch Tuesday, but hours later a working exploit arrived for a Windows flaw the updates don’t fully close. CISA confirmed active exploitation of a building automation protocol used in UK commercial premises, where attackers can lock climate control, lighting, and access systems. Firefox shipped two critical remote code execution vulnerabilities with public exploit code already in circulation. For small businesses, the gap between patch release and deployment creates a measurable, exploitable window. This episode breaks down what actually happened this week, what the technical jargon means in practice, and which actions you can take today before the next wave begins. Speed is the variable that determines whether this week’s vulnerabilities become next week’s breach.

On 14 July 2026, Microsoft released 622 vulnerabilities in a single Patch Tuesday, the largest in company history. Buried within that release are two zero-day vulnerabilities actively exploited in the wild: CVE-2026-56164 (SharePoint Server privilege escalation) and CVE-2026-56155 (AD FS local privilege escalation), both confirmed by CISA’s Known Exploited Vulnerabilities catalogue. Two additional critical Remote Desktop Protocol vulnerabilities (CVE-2026-54990 and CVE-2026-56190) allow unauthenticated remote code execution with CVSS scores of 9.8. Running concurrently, two SonicWall SMA1000 vulnerabilities (CVE-2026-15409 and CVE-2026-15410) form a complete attack chain from unauthenticated access to operating system command execution. This episode examines what these vulnerabilities mean for UK small businesses, particularly those in supply chain relationships with larger clients, and provides actionable guidance on patch prioritisation, RDP security, MSP accountability, and Cyber Essentials compliance requirements.