The Daily CVE Update

CISA has confirmed active exploitation of two Joomla extensions, iCagenda and Balbooa Forms, both vulnerable to unauthenticated PHP code execution. The vulnerabilities, tracked as CVE-2026-48939 and CVE-2026-56291, allow attackers to run code without credentials, creating immediate legal and operational risks for UK small businesses running Joomla websites. Australia’s cybersecurity agency flagged these as part of a coordinated campaign targeting CMS platforms. For businesses holding customer data, this represents a potential GDPR personal data breach with mandatory ICO notification requirements within 72 hours of awareness. Meanwhile, emerging threat intelligence describes JADEPUFFER, a ransomware strain reportedly using AI agents to automate reconnaissance, target selection, and extortion communication. While confidence in JADEPUFFER intelligence remains moderate, it illustrates a concerning directional shift: ransomware operations becoming increasingly automated and economical to deploy against smaller targets previously considered too labour-intensive to attack. This episode provides actionable guidance for checking Joomla installations, reviewing hosting logs, engaging web agencies with specific questions, understanding GDPR breach notification obligations, and subscribing to the NCSC Early Warning Service.

On 10 July 2026, two critical vulnerabilities require immediate attention from UK small businesses. CVE-2026-58123, affecting Hermes WebUI, scores 9.8 on the CVSS scale and permits unauthenticated remote code execution through four HTTP requests with no credentials required. CVE-2026-58122, rated 9.1, allows attackers to bypass local-origin protections and conduct server-side request forgery. Microsoft patched CVE-2026-50656 (RoguePlanet), a Windows Defender elevation-of-privilege flaw with publicly available exploit code since 10 June, but the patch may cause disk space exhaustion on affected machines. This episode examines why security and infrastructure tools have become primary attack vectors, analyses the 30-day window between exploit publication and patch availability, and provides five specific actions to complete before the end of the week. Host Corrine Jefferson explains how documented vulnerability response creates competitive advantage in procurement conversations and demonstrates security posture to clients with supply chain requirements.

Two critical vulnerabilities have been published in the last 24 hours, both requiring immediate attention from UK small businesses. CVE-2026-58480 affects Blocksy Companion Pro, a widely deployed WordPress plugin, scoring 9.8 on the CVSS severity scale. The flaw allows unauthenticated remote code execution through inadequate file upload validation, enabling attackers to upload and execute malicious PHP files by exploiting a substring matching error in the plugin’s validation logic. CVE-2026-47646 targets Microsoft Dynamics 365 Customer Voice with a CVSS score of 9.3, enabling unauthenticated cross-site scripting attacks that facilitate spoofing of legitimate business communications. This week, CISA added four vulnerabilities to its Known Exploited Vulnerabilities catalogue, including two Joomla plugin flaws with maximum CVSS scores of 10.0, both involving identical file upload validation failures. The pattern is clear: CMS plugins with inadequate upload validation are being systematically targeted through automated scanning. Small businesses must verify that Blocksy Companion Pro has been updated to version 2.1.47 immediately, confirm their web providers have documented patch management processes, and ensure Microsoft 365 automatic updates are enabled. The gap between vulnerability publication and active exploitation is now measured in hours, making same-day patching essential for maintaining security posture and meeting Cyber Essentials certification requirements.

Two critical vulnerabilities are under active exploitation right now, with direct implications for UK small businesses. Adobe ColdFusion CVE-2026-48282 carries a perfect CVSS 10.0 score and was weaponised within two hours of public disclosure. The vulnerability allows unauthenticated remote code execution on affected servers. Meanwhile, SimpleHelp RMM CVE-2026-48558 enables attackers to create Technician accounts on unpatched servers, granting access to every client system managed through that infrastructure. Hundreds of vulnerable SimpleHelp servers remain exposed worldwide weeks after patches became available. Both vulnerabilities highlight a structural problem: attackers now operate at machine speed whilst defenders, particularly in under-resourced environments, operate at human speed. Monthly patch cycles are structurally inadequate when exploitation timelines are measured in hours. This episode provides three specific, answerable questions to ask your IT provider before the end of the week, with guidance on why written responses matter for cyber insurance and due diligence. The NCSC’s vulnerability management and supply chain security guidance is referenced throughout. Your MSP’s patch status is your risk, not theirs.

CISA has confirmed active exploitation of CVE-2026-45659, a remote code execution vulnerability in Microsoft SharePoint Server. UK small businesses running on-premises SharePoint need to verify patch status immediately, not when convenient. This episode examines the gap between Microsoft’s May patch release and delayed security bulletin, explains why basic site members can exploit this flaw to gain server control, and clarifies the distinction between cloud-hosted and on-premises risk. We also cover JADEPUFFER, the first documented ransomware attack conducted entirely by an AI agent without human operators, and FortiBleed, a credential theft campaign targeting Fortinet devices that fed directly into INC and Lynx ransomware operations. The common thread: automated attack pipelines are eliminating the economic barriers that previously made small businesses lower-priority targets. Corrine provides five specific actions to complete before the end of the week, including how to verify your SharePoint patch status, check AI development tool exposure, confirm Fortinet firmware versions, test offline backups, and request patch reports from your MSP.

CISA added Microsoft SharePoint Server to its Known Exploited Vulnerabilities catalogue on 1 July 2026, confirming active exploitation of CVE-2026-45659. This deserialization flaw allows authenticated attackers to run arbitrary code on vulnerable servers. UK small businesses running on-premises or hybrid SharePoint deployments must verify patch status immediately. Meanwhile, the NIST NVD revealed hardcoded credentials in JAIOTlink C492A-W6 IP cameras and unauthenticated command injection in Shenzhen Aitemi M300 Wi-Fi repeaters, exposing cheap networked devices as unlocked entry points. Finally, researchers demonstrated AI-generated ransomware that exploits the Chromium File System Access API to encrypt files through browser permissions users have already granted. Google released Chrome 150, patching 382 vulnerabilities including 15 critical flaws. This episode explains why browser patching, device inventories, and permission audits are now procurement-level requirements, not IT housekeeping. Corrine delivers actionable guidance: demand specific CVE remediation timelines from your MSP, catalogue every networked device, revoke unnecessary browser permissions, and review cyber insurance coverage for browser-based attack vectors.

On 29 June 2026, CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalogue. This CVSS 10.0 authentication bypass flaw in SimpleHelp, a widely deployed remote monitoring and management platform, allows attackers to create privileged technician accounts without credentials. Active exploitation campaigns have already deployed TaskWeaver persistent access malware and Djinn Stealer credential harvesting tools through compromised RMM servers. For UK small businesses, the risk is direct: if your managed service provider uses an unpatched SimpleHelp instance, every system they manage is exposed through a single vulnerability. This episode provides specific, actionable steps for verifying whether your MSP has patched, how to assess your exposure through shared infrastructure, and what your incident response plan should account for when the threat comes through a trusted third party. Also covered: two additional CVSS 10.0 remote code execution vulnerabilities in Adobe ColdFusion (CVE-2026-48276 and CVE-2026-48277) affecting legacy web infrastructure, and practical guidance on managing third-party IT security risk under UK GDPR data processor obligations.

On 29 June 2026, CISA added CVE-2026-48558 to its Known Exploited Vulnerabilities catalogue, confirming active exploitation of an authentication bypass in SimpleHelp remote support software. The flaw allows attackers to forge identity tokens and gain full technician access without credentials or multi-factor authentication. Because the vulnerability exists in IT providers’ infrastructure rather than client systems, UK small businesses face supply chain risk they cannot directly patch or monitor. Separately, CVE-2026-55200, a critical remote code execution vulnerability in libssh2, has a public proof-of-concept exploit available. libssh2 is embedded in numerous server administration and file transfer tools. This episode explains both vulnerabilities in practical terms and provides specific questions businesses should ask their IT providers immediately, including written confirmation of patching status, privileged access controls, and contractual notification obligations for critical security disclosures.

Today’s episode of The Daily CVE Update, hosted by Corrine Jefferson, focuses on two critical vulnerabilities impacting UK small businesses. We delve into CVE-2026-12569 in PTC’s Windchill and FlexPLM software, which threatens product lifecycle and supply chain management by allowing unauthorised code execution. Additionally, CVE-2026-20230 targets Cisco’s Unified Communications Manager, posing a severe risk to organisational communications through remote code execution. These vulnerabilities are actively exploited, highlighting the urgency for businesses to patch systems promptly. Corrine discusses the importance of maintaining competitive advantage by being proactive in cybersecurity and provides insights on communicating these risks to board members. The episode concludes with actionable steps, including deploying necessary patches, conducting an asset review, and enhancing real-time threat monitoring.

In today’s episode, Corrine highlights critical vulnerabilities affecting WordPress plugins and Cisco Unified Communications Manager. Two WordPress plugins, Invoice Generator and SignUp & SignIn, are vulnerable to attacks that could compromise admin accounts. With a CVSS score of 9.8, these flaws pose serious risks, allowing attackers to reset passwords without verification. Additionally, a Cisco flaw, actively exploited, endangers communication infrastructures by enabling file manipulation. Corrine emphasises the importance of timely updates and strong cybersecurity practices to safeguard business data and reputation. Stay informed and proactive to turn these security challenges into a competitive advantage.