Every article by Corrine Jefferson. Straight-talking cybersecurity advice for UK small businesses.https://thesmallbusinesscybersecurityguy.co.uk/en-gbhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-small-business-cybersecurity-update-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-small-business-cybersecurity-update-2026/Unpack today's critical vulnerabilities threatening small businesses: IBM, Spikster, and WordPress under fire.Fri, 31 Jul 2026 09:00:00 GMTsmb-securityuk-businessvendor-riskcloud-securitycompliance-failureCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-small-business-cybersecurity-threat-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-small-business-cybersecurity-threat-2026/Newly discovered vulnerabilities expose UK businesses to unauthorised access and serious risks. Here's what you need to know.Thu, 30 Jul 2026 09:00:00 GMTsmb-securityuk-businessvendor-riskcredential-theftincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/ibm-websphere-security-flaws-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/ibm-websphere-security-flaws-2026/Discover critical security flaws in IBM WebSphere impacting UK small businesses. Act now to secure your operations.Wed, 29 Jul 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftbusiness-riskvendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/fortios-velocloud-vulnerabilities-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/fortios-velocloud-vulnerabilities-uk-smb-2026/FortiOS and VeloCloud vulnerabilities expose UK SMBs to critical risks. Don't wait, take action now.Tue, 28 Jul 2026 09:00:00 GMTsmb-securityuk-businessnetwork-securitybusiness-riskvulnerability-managementCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-small-business-cybersecurity-threats-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-small-business-cybersecurity-threats-2026/Fastjson and Cl0p ransomware exploitations are active. Know the risks and defensive steps.Mon, 27 Jul 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsbusiness-riskremote-accessCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/critical-security-alerts-uk-smbs-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/critical-security-alerts-uk-smbs-2026/Microsoft Exchange and Azure vulnerabilities demand immediate attention from UK SMEs.Fri, 24 Jul 2026 09:00:00 GMTsmb-securityuk-businessbusiness-riskremote-accessincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/small-business-cybersecurity-alert-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/small-business-cybersecurity-alert-2026/Exploited vulnerabilities in SharePoint and Oracle put small businesses at risk. Act fast to secure your infrastructure.Thu, 23 Jul 2026 09:00:00 GMTsmb-securityuk-businessincident-responsecloud-securityvendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-oracle-vulnerabilities-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-oracle-vulnerabilities-uk-smb-2026/WordPress and Oracle flaws threaten UK SMBs. Here's what you need to do now to secure your business.Wed, 22 Jul 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftcompliance-failurevendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-cyber-threat-brief-21-july-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-cyber-threat-brief-21-july-2026/Three stories this week. All of them matter. One of them is watching your car park right now.Tue, 21 Jul 2026 09:00:00 GMTsmb-securityuk-businessnation-state-attackssocial-engineeringiot-surveillanceransomware-groupssupply-chain-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/sonicwall-zero-days-nginx-flaw-uk-smb-briefing-july-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/sonicwall-zero-days-nginx-flaw-uk-smb-briefing-july-2026/Two serious vulnerabilities landed this week. One was exploited before anyone even knew it existed. Here is the plain-English briefing for UK small businesses.Mon, 20 Jul 2026 09:00:00 GMTsmb-securityuk-businessremote-accessvendor-riskincident-responsebusiness-riskmsp-securityCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/sharepoint-exploited-zoom-wireguard-uk-smb-july-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/sharepoint-exploited-zoom-wireguard-uk-smb-july-2026/CISA added a Microsoft SharePoint remote code execution flaw to its active exploitation list on 16 July 2026. Here is what UK small businesses need to do today.Fri, 17 Jul 2026 09:00:00 GMTsmb-securityuk-businessremote-accesscredential-theftbusiness-riskcloud-securityincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/patch-tuesday-july-2026-zero-day-knx-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/patch-tuesday-july-2026-zero-day-knx-uk-smb-2026/570 Microsoft patches. A Windows zero-day PoC published hours later. A building automation protocol now on the CISA KEV list. This week is not one to ignore.Thu, 16 Jul 2026 07:00:00 GMTsmb-securityuk-businessincident-responsebusiness-riskcompliance-failureremote-accesssupply-chain-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/microsoft-patch-tuesday-july-2026-zero-days-uk-smb/https://thesmallbusinesscybersecurityguy.co.uk/blog/microsoft-patch-tuesday-july-2026-zero-days-uk-smb/Two Microsoft zero-days are being actively exploited right now. One requires no login whatsoever. Here is what to do before close of business.Wed, 15 Jul 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsremote-accessbusiness-riskcompliance-failureincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/joomla-zero-day-exploits-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/joomla-zero-day-exploits-uk-smb-2026/Attackers are executing arbitrary code on Joomla websites right now. CISA confirmed it. Here is what UK small businesses need to do today.Tue, 14 Jul 2026 09:00:00 GMTsmb-securityuk-businessvendor-risksupply-chain-riskincident-responsecompliance-failurebusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/hermes-webui-rce-windows-defender-rogueplanet-uk-smb-briefing-july-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/hermes-webui-rce-windows-defender-rogueplanet-uk-smb-briefing-july-2026/Two critical vulnerabilities this week prove that your security tools are now the target. Here is the plain-English briefing.Fri, 10 Jul 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsremote-accessbusiness-riskincident-responsevendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-blocksy-cve-2026-58480-rce-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-blocksy-cve-2026-58480-rce-uk-smb-2026/CVSS 9.8. No authentication required. A WordPress plugin flaw published yesterday lets attackers run arbitrary code on your server. Here is what it means.Thu, 09 Jul 2026 09:00:00 GMTsmb-securityuk-businessvendor-riskcompliance-failurebusiness-risksupply-chain-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/coldfusion-cve-2026-48282-simplehelp-rmm-exploited-july-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/coldfusion-cve-2026-48282-simplehelp-rmm-exploited-july-2026/A perfect-10 Adobe flaw exploited within two hours. Hundreds of unpatched RMM servers still exposed. Two stories your IT provider needs to hear today.Tue, 07 Jul 2026 09:00:00 GMTsmb-securityuk-businessmsp-securitysupply-chain-riskincident-responsevendor-riskremote-accessCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/sharepoint-cve-2026-45659-exploited-ai-ransomware-july-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/sharepoint-cve-2026-45659-exploited-ai-ransomware-july-2026/A SharePoint vulnerability is being actively exploited right now. CISA confirmed it. Microsoft sat on the disclosure for weeks. Here is what you need to know.Fri, 03 Jul 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsincident-responsecloud-securityvendor-riskbusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/sharepoint-exploit-ip-cameras-ai-ransomware-smb-brief-july-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/sharepoint-exploit-ip-cameras-ai-ransomware-smb-brief-july-2026/SharePoint has a confirmed, actively-exploited code execution flaw. CISA added it to the KEV list yesterday. If your business uses SharePoint, read this now.Thu, 02 Jul 2026 08:00:00 GMTsmb-securityuk-businessransomware-groupsremote-accessbusiness-riskincident-responsevendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/simplehelp-cve-2026-48558-msp-rce-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/simplehelp-cve-2026-48558-msp-rce-uk-smb-2026/A maximum-severity flaw in SimpleHelp RMM is being actively exploited. Attackers are walking straight through your MSP's front door. Here is what that means for your business.Wed, 01 Jul 2026 09:00:00 GMTsmb-securitymsp-securitycredential-theftsupply-chain-riskremote-accessincident-responseuk-businessCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/simplehelp-authentication-bypass-cve-2026-48558-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/simplehelp-authentication-bypass-cve-2026-48558-uk-smb-2026/The remote support tool your IT provider uses to fix your computers has a flaw that lets attackers walk straight in. No password required.Tue, 30 Jun 2026 09:00:00 GMTsmb-securityuk-businessmsp-securityremote-accesscredential-theftvendor-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/critical-vulnerabilities-uk-smbs-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/critical-vulnerabilities-uk-smbs-2026/WordPress plugin flaws and a Cisco exploit are high-risk for UK SMBs. Urgent updates recommended.Thu, 25 Jun 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftincident-responsebusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/critical-vulnerabilities-uk-smes-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/critical-vulnerabilities-uk-smes-2026/Lantronix and UniFi OS vulnerabilities demand immediate attention from UK SMEs to prevent breaches.Wed, 24 Jun 2026 09:00:00 GMTsmb-securityuk-businesscompliance-failurebusiness-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/fortinet-forticloud-sso-bypass-edge-trust-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/fortinet-forticloud-sso-bypass-edge-trust-uk-smb-2026/An authentication bypass leaves a quiet signal: admin activity, not exploit traffic. Most small businesses are not watching for it.Wed, 24 Jun 2026 09:00:00 GMTsmb-securityuk-businessremote-accesscredential-theftvendor-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/critical-vulnerabilities-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/critical-vulnerabilities-uk-smb-2026/Ignoring IBM Langflow and WordPress plugin threats could sink your SMB. Here's what you need to know.Tue, 23 Jun 2026 09:00:00 GMTsmb-securityuk-businesscloud-securitybusiness-riskvendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-small-business-cybersecurity-vulnerabilities-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-small-business-cybersecurity-vulnerabilities-2026/Legacy routers infected by AryStinger show why UK SMBs need to update their network security.Mon, 22 Jun 2026 09:00:00 GMTsmb-securityuk-businessnetwork-securityincident-responsevendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-threat-briefing-19-june-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-threat-briefing-19-june-2026/Three threats that landed overnight. One is actively exploited right now. Here is what UK small businesses need to know before Friday.Fri, 19 Jun 2026 09:00:00 GMTransomware-groupssmb-securityuk-businessincident-responseremote-accesssupply-chain-riskbusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/rogueplanet-defender-zero-day-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/rogueplanet-defender-zero-day-uk-smb-2026/Microsoft has confirmed a Defender zero-day with no patch in sight. If your business runs Windows, this is not a drill.Thu, 18 Jun 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsincident-responsebusiness-riskcompliance-failurevendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/joomla-jce-exploit-defender-zero-day-uk-smb-june-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/joomla-jce-exploit-defender-zero-day-uk-smb-june-2026/CISA confirmed active exploitation of a Joomla plugin flaw on Tuesday. Microsoft has no patch for its Defender zero-day. Two fires, one week. Here is what to do.Wed, 17 Jun 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsvendor-riskincident-responsebusiness-riskcompliance-failureCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/joomla-jwt-active-exploitation-uk-smb-brief-june-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/joomla-jwt-active-exploitation-uk-smb-brief-june-2026/Two critical vulnerabilities confirmed in active exploitation this week. If you run Joomla or use any web application with token-based login, read this now.Wed, 17 Jun 2026 09:00:00 GMTsmb-securityuk-businessvendor-riskcompliance-failurebusiness-riskremote-accessincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-backdoors-shared-hosting-m365-copilot-threats-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-backdoors-shared-hosting-m365-copilot-threats-2026/Three stories from the last 24 hours that should matter to every small business in the UK. Two are actively exploited. One was patched three weeks after it was found.Tue, 16 Jun 2026 09:00:00 GMTsmb-securityuk-businesssupply-chain-riskcloud-securityvendor-riskincident-responsebusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/splunk-rce-cve-2026-20253-uk-smb-supply-chain-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/splunk-rce-cve-2026-20253-uk-smb-supply-chain-2026/Splunk has a 9.8-rated unauthenticated remote code execution flaw. You probably don't run Splunk. Your MSP might. That's the problem.Mon, 15 Jun 2026 09:00:00 GMTsmb-securityuk-businesssupply-chain-riskmsp-securityvendor-riskremote-accessbusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/gentlemen-ransomware-bitlocker-bypass-smb-brief-june-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/gentlemen-ransomware-bitlocker-bypass-smb-brief-june-2026/478 victims, worm-like spread, and a BitLocker bypass that works on patched Windows. This week's threats are not theoretical. Here is the brief.Fri, 12 Jun 2026 09:00:00 GMTransomware-groupssmb-securityuk-businessincident-responsebusiness-riskcredential-theftremote-accessCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/threat-brief-wordpress-admin-takeover-jdy-botnet-june-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/threat-brief-wordpress-admin-takeover-jdy-botnet-june-2026/No credentials required. A WordPress plugin flaw published yesterday lets unauthenticated attackers create admin accounts. Here is what to do before lunch.Thu, 11 Jun 2026 09:00:00 GMTsmb-securityuk-businessnation-state-attacksvendor-risksupply-chain-riskbusiness-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/patch-tuesday-june-2026-uk-smb-action-guide/https://thesmallbusinesscybersecurityguy.co.uk/blog/patch-tuesday-june-2026-uk-smb-action-guide/Microsoft's biggest-ever Patch Tuesday, a critical Veeam backup flaw, and a WordPress plugin that hands attackers your server. Three stories. One to-do list.Wed, 10 Jun 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsincident-responsecompliance-failurevendor-riskbusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/check-point-vpn-wordpress-rce-uk-smb-june-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/check-point-vpn-wordpress-rce-uk-smb-june-2026/Attackers bypassed Check Point VPN passwords in the wild before a patch existed. If your remote access still runs IKEv1, you are already compromised.Tue, 09 Jun 2026 09:00:00 GMTsmb-securityuk-businessremote-accesscredential-theftvendor-riskbusiness-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/cisco-sdwan-solarwinds-servu-exploits-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/cisco-sdwan-solarwinds-servu-exploits-uk-smb-2026/Cisco SD-WAN and SolarWinds Serv-U are both being actively exploited this week. One has no patch. Here is the data, stripped of vendor spin.Mon, 08 Jun 2026 09:00:00 GMTsmb-securityuk-businessvendor-risksupply-chain-riskmsp-securityincident-responsebusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-magento-actively-exploited-uk-smb-june-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-magento-actively-exploited-uk-smb-june-2026/CISA just added two actively exploited flaws to its KEV catalog. If you run WordPress or Magento, you are in the crosshairs today.Fri, 05 Jun 2026 09:00:00 GMTsmb-securityuk-businessvendor-riskcompliance-failurebusiness-riskincident-responsesupply-chain-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-cyber-threat-brief-june-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-cyber-threat-brief-june-2026/Two WordPress flaws scored 9.8. An unpatched Windows credential leak has no CVE number. Here is what UK small businesses need to act on this week.Wed, 03 Jun 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftvendor-riskransomware-groupsremote-accesscompliance-failureCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/windows-netlogon-cve-2026-41089-actively-exploited-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/windows-netlogon-cve-2026-41089-actively-exploited-2026/Attackers are actively exploiting a critical Windows Netlogon flaw. No login required. One packet and your domain controller is compromised.Tue, 02 Jun 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsremote-accessbusiness-riskincident-responseinfrastructure-securityCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/pan-os-auth-bypass-cve-2026-0257-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/pan-os-auth-bypass-cve-2026-0257-uk-smb-2026/Palo Alto's GlobalProtect VPN has a confirmed authentication bypass under active exploitation. If you haven't patched, your network perimeter is already open.Mon, 01 Jun 2026 09:00:00 GMTsmb-securityuk-businessremote-accessvendor-riskincident-responsenetwork-securitycompliance-failureCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/forticlient-malware-ai-attacks-wordpress-threat-brief-may-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/forticlient-malware-ai-attacks-wordpress-threat-brief-may-2026/Fake Fortinet patches, AI-driven database raids, and a WordPress plugin handing out admin rights to strangers. Three stories that matter this week.Fri, 29 May 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftransomware-groupssupply-chain-riskremote-accessbusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-otp-bypass-windows-kernel-flaw-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-otp-bypass-windows-kernel-flaw-smb-2026/Attackers can brute-force their way into any WordPress account in minutes. A Windows kernel flaw hands them SYSTEM privileges. Both need fixing today.Thu, 28 May 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftcompliance-failurebusiness-riskremote-accessCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/joomla-ghost-sharepoint-critical-patches-may-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/joomla-ghost-sharepoint-critical-patches-may-2026/Joomla has three privilege escalation flaws scored 9.8. Ghost CMS is already being exploited across 700 websites. SharePoint needs patching now.Wed, 27 May 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsvendor-riskincident-responsecompliance-failurebusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/ghost-cms-clickfix-attack-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/ghost-cms-clickfix-attack-uk-smb-2026/Seven hundred-plus websites turned into traps. One fake CAPTCHA. One click. Full device compromise. This is ClickFix, and it is coming for your team.Tue, 26 May 2026 09:00:00 GMTsmb-securityuk-businesssocial-engineeringsupply-chain-riskbusiness-riskincident-responsevendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/drupal-cve-2026-9082-actively-exploited-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/drupal-cve-2026-9082-actively-exploited-uk-smb-2026/Drupal's being actively exploited right now. 15,000 attempts, 65 countries, CISA confirmed. If your site runs Drupal, you have a deadline of 27 May.Mon, 25 May 2026 08:00:00 GMTsmb-securityuk-businessvendor-riskbusiness-riskcompliance-failuresupply-chain-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-critical-vulnerabilities-uk-smb-may-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-critical-vulnerabilities-uk-smb-may-2026/Three WordPress plugins just handed attackers the keys to your website. CVSS 9.8. No login required. Here is what to do before Friday.Fri, 22 May 2026 09:00:00 GMTsmb-securityuk-businessvendor-riskcompliance-failurebusiness-risksupply-chain-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/yellowkey-wordpress-smb-threats-may-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/yellowkey-wordpress-smb-threats-may-2026/A USB stick defeats BitLocker. Three WordPress plugins hand attackers full admin access. The intelligence is clear. Here is what to do about it.Thu, 21 May 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupscredential-theftinfrastructure-securitybusiness-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/microsoft-exchange-cisa-exploit-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/microsoft-exchange-cisa-exploit-uk-smb-2026/CISA confirmed active exploitation of a Microsoft Exchange vulnerability this week. UK small businesses running on-premise email need to act today.Tue, 19 May 2026 09:00:00 GMTsmb-securityuk-businessremote-accessincident-responsebusiness-riskcompliance-failurevendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/nginx-cve-2026-42945-active-exploitation-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/nginx-cve-2026-42945-active-exploitation-uk-smb-2026/NGINX powers roughly a third of the web. CVE-2026-42945 is being exploited right now. Here is what UK small businesses need to do before Friday.Mon, 18 May 2026 09:00:00 GMTsmb-securityuk-businessremote-accessinfrastructure-securitybusiness-riskincident-responsesupply-chain-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-authenticator-exchange-vulnerabilities-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-authenticator-exchange-vulnerabilities-uk-smb-2026/Three critical flaws landed overnight. WordPress sites, Microsoft Authenticator, and on-premises email are all in the frame. Here is the data, without the spin.Fri, 15 May 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftcompliance-failurebusiness-riskremote-accessvendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/may-2026-patch-tuesday-uk-smb-action-guide/https://thesmallbusinesscybersecurityguy.co.uk/blog/may-2026-patch-tuesday-uk-smb-action-guide/A wormable Windows Server flaw, a payment platform with a forgeable secret key, and 130 patches. Here is what matters to your business this week.Thu, 14 May 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupssupply-chain-riskbusiness-riskvendor-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/patch-tuesday-may-2026-smb-action-guide/https://thesmallbusinesscybersecurityguy.co.uk/blog/patch-tuesday-may-2026-smb-action-guide/120 vulnerabilities. A critical Windows Netlogon flaw. A Windows DNS buffer overflow. This is not a drill. Here is what to do this week.Wed, 13 May 2026 09:00:00 GMTsmb-securityuk-businessbusiness-riskcompliance-failureremote-accessinfrastructure-securityincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-cyber-threats-cpanel-backdoor-linux-ico-fine-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-cyber-threats-cpanel-backdoor-linux-ico-fine-2026/Three stories this week that every UK small business owner needs to hear. One phishing email. Twenty months undetected. One million pounds.Tue, 12 May 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupscompliance-failureincident-responsevendor-riskbusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/msp-pricing-anatomy-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/msp-pricing-anatomy-uk-smb-2026/Strip out Microsoft licensing. If your provider is below £50 per user per month outside London or £75 inside it, something has been removed. The maths does not lie.Tue, 12 May 2026 07:00:00 GMTsmb-securityuk-businessmsp-securitybusiness-riskvendor-riskexecutive-securityCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-cpanel-ivanti-threats-uk-smb-may-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-cpanel-ivanti-threats-uk-smb-may-2026/Attackers can own your WordPress store without a password. cPanel has fresh critical flaws. CISA just confirmed active exploitation of Ivanti. Three reasons to act today.Mon, 11 May 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsvendor-risksupply-chain-riskincident-responsecloud-securityCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/ivanti-epmm-zero-day-exploited-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/ivanti-epmm-zero-day-exploited-uk-smb-2026/Attackers are inside Ivanti EPMM before patches existed. If your business manages mobile devices, this is not someone else's problem.Fri, 08 May 2026 07:29:00 GMTsmb-securityuk-businessremote-accesscredential-theftincident-responsevendor-riskbusiness-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/pan-os-cve-2026-0300-active-exploit-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/pan-os-cve-2026-0300-active-exploit-uk-smb-2026/A critical Palo Alto firewall flaw is being actively exploited with no patch yet available. If your MSP manages a PAN-OS device, ask them one question.Thu, 07 May 2026 09:00:00 GMTsmb-securityuk-businessmsp-securityremote-accessbusiness-riskincident-responsevendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/de-dnssec-outage-broken-signature-dns-failure-uk-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/de-dnssec-outage-broken-signature-dns-failure-uk-2026/A single broken cryptographic signature took large parts of Germany's internet offline. Your business has the same invisible dependency.Thu, 07 May 2026 08:28:00 GMTsmb-securityuk-businessbusiness-riskvendor-riskincident-responsesupply-chain-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-cyber-threat-brief-6-may-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-cyber-threat-brief-6-may-2026/WordPress sites can be taken over without a password. A Linux root exploit is being actively weaponised. And a nation-state group is still walking through Exchange servers that weren't patched in 2021.Wed, 06 May 2026 09:00:00 GMTsmb-securityuk-businessransomware-groupsnation-state-attackssupply-chain-riskvendor-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/phishing-identity-controls-uk-business-survey-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/phishing-identity-controls-uk-business-survey-2026/Phishing caused 69% of the most disruptive breaches. 51% of victims were hit by phishing alone. The fight has moved from inboxes to identity controls.Tue, 05 May 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftsocial-engineeringbusiness-riskcompliance-failureCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-cyber-brief-5-may-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/uk-smb-cyber-brief-5-may-2026/cPanel is on CISA's active exploit list. MOVEit has a new authentication bypass. Your cheap router may already be compromised. Here is what matters today.Tue, 05 May 2026 08:00:00 GMTsmb-securityuk-businessransomware-groupscredential-theftsupply-chain-riskvendor-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/linux-root-access-cve-2026-31431-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/linux-root-access-cve-2026-31431-uk-smb-2026/CISA confirmed active exploitation of a Linux root access flaw this week. If your business runs Linux anywhere, including on a NAS or cloud VM, read this now.Mon, 04 May 2026 09:00:00 GMTsmb-securityuk-businessinfrastructure-securityremote-accessincident-responsebusiness-riskcloud-securityCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-critical-vulnerabilities-smb-may-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/wordpress-critical-vulnerabilities-smb-may-2026/Unauthenticated attackers can upload malware or log in as your site admin right now. Two critical WordPress flaws. No patch excuses.Sun, 03 May 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftcompliance-failurebusiness-riskvendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/cpanel-wordpress-auth-bypass-smb-threats-may-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/cpanel-wordpress-auth-bypass-smb-threats-may-2026/44,000 hosting control panels confirmed compromised. A WordPress plugin is handing out admin access to anyone who asks. This week's threats are not theoretical.Sat, 02 May 2026 09:00:00 GMTsmb-securityuk-businesscredential-theftvendor-riskcloud-securitybusiness-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/copyfail-linux-rce-uk-smb-threat-brief-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/copyfail-linux-rce-uk-smb-threat-brief-2026/Public exploit code for a Linux root access flaw has defenders scrambling. If your business runs Linux anywhere, this is not a drill.Fri, 01 May 2026 05:00:00 GMTsmb-securityuk-businessinfrastructure-securityremote-accessvendor-riskbusiness-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/windows-zero-click-apt28-router-cves-uk-smb-brief-april-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/windows-zero-click-apt28-router-cves-uk-smb-brief-april-2026/Russian state hackers are in your Windows machine without a click. Five router flaws scored 9.8 overnight. This week's threat brief cuts through the noise.Wed, 29 Apr 2026 05:00:00 GMTsmb-securityuk-businessnation-state-attacksremote-accessbusiness-riskincident-responsevendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/totolink-a8000ru-critical-vulnerabilities-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/totolink-a8000ru-critical-vulnerabilities-uk-smb-2026/Nineteen critical flaws. One router model. All exploits published. If your office uses a Totolink A8000RU, you are already exposed.Tue, 28 Apr 2026 07:38:00 GMTsmb-securityuk-businessremote-accessnetwork-securitybusiness-riskvendor-riskincident-responseCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/simplehelp-vulnerabilities-msp-risk-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/simplehelp-vulnerabilities-msp-risk-uk-smb-2026/CISA just added SimpleHelp remote support vulnerabilities to its actively-exploited list. If your IT provider uses it, attackers may already have a path in.Sun, 26 Apr 2026 09:00:00 GMTsmb-securitymsp-securityremote-accesssupply-chain-riskvendor-riskincident-responseuk-businessCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/fourth-party-supply-chain-risk-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/fourth-party-supply-chain-risk-uk-smb-2026/61% of organisations were breached through their supply chain last year. Just 7% monitor beyond immediate suppliers. That is a structural failure, not bad luck.Mon, 20 Apr 2026 16:00:00 GMTsmb-securityuk-businesssupply-chain-riskvendor-riskbusiness-riskcloud-securitycompliance-failureCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/stac6405-rmm-phishing-logmein-screenconnect-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/stac6405-rmm-phishing-logmein-screenconnect-uk-smb-2026/Attackers are weaponising the same remote access tools your IT team uses. Sophos has the receipts. Here is what happened and what you need to do.Wed, 08 Apr 2026 10:00:00 GMTsocial-engineeringremote-accessmsp-securitycredential-theftsmb-securityuk-businessvendor-riskCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/windows-bluehammer-fortinet-zero-day-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/windows-bluehammer-fortinet-zero-day-uk-smb-2026/Two working exploits in one week. One public, one confirmed in the wild. Neither fully patched. Here is what UK SMBs need to do right now.Tue, 07 Apr 2026 09:43:00 GMTsmb-securityuk-businessbusiness-riskvendor-riskmsp-securityCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/the-rise-of-whatsapp-malware-what-uk-smbs-should-know/https://thesmallbusinesscybersecurityguy.co.uk/blog/the-rise-of-whatsapp-malware-what-uk-smbs-should-know/Discover the new WhatsApp malware targeting UK SMBs. Learn how to protect your business from harmful VBS payloads and MSI backdoors.Tue, 31 Mar 2026 16:28:00 GMTWhatsAppmalwarecybersecurityUK SMBsCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/supply-chain-attacks-how-uk-smbs-can-protect-themselves/https://thesmallbusinesscybersecurityguy.co.uk/blog/supply-chain-attacks-how-uk-smbs-can-protect-themselves/Is your business unknowingly at risk? Discover how supply chain attacks threaten your operations and learn the essential steps to safeguard your future.Sun, 29 Mar 2026 08:00:00 GMTsupply chaincybersecuritysoftware securitysmall businessCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/the-future-of-cybersecurity-preparing-for-ai-driven-threats/https://thesmallbusinesscybersecurityguy.co.uk/blog/the-future-of-cybersecurity-preparing-for-ai-driven-threats/AI-driven threats are evolving fast. Is your business keeping up? Discover how to protect your enterprise from cutting-edge cybercriminal tactics.Fri, 27 Mar 2026 21:00:00 GMTAICybersecurityThreatsSmall BusinessCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/bank-of-england-cbest-2025-financial-sector-cyber-failures-uk-smb-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/bank-of-england-cbest-2025-financial-sector-cyber-failures-uk-smb-2026/The Bank of England runs live cyberattack simulations on the UK's most critical financial institutions every year. Real attacks, on live systems, designed by intelligence analysts who know exactly how sophisticated threat actors operate. The 2025 results are in. Weak passwords. Overly permissive access controls. Systems that haven't been patched. Staff who hand over credentials when asked convincingly. Third year running. Same findings. If the institutions that hold your money, process your payrWed, 11 Mar 2026 00:00:00 GMTnation-state-attacksuk-businesssmb-securitycompliance-failureexecutive-securitybusiness-risk2026-threatsCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/unit-42-identity-security-analysis-uk-business-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/unit-42-identity-security-analysis-uk-business-2026/I spent time with Mauven this week working through the Unit 42 Global Incident Response Report 2026. Seven hundred and fifty incident response engagements. Fifty-plus countries. Real cases. The headline statistic, 89% of investigations involving identity as a material factor, is striking. But it's not the number that should concern you most. It's what that number tells us about where organisations are spending their security budgets versus where attackers are actually operating. They are not in Fri, 06 Mar 2026 00:00:00 GMTidentity-securityunit-42-reportcredential-theftmfa-bypasssmb-securityuk-business2025-threatsCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/personal-data-definition-controller-perspective-uk-gdpr-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/personal-data-definition-controller-perspective-uk-gdpr-2026/In September 2024, a UK tribunal concluded that 5.6 million stolen card records might not constitute personal data. The argument was structural, not frivolous. Hackers who cannot identify individuals from card numbers alone are not, the Upper Tribunal suggested, processing personal data. The Court of Appeal corrected that in February 2026. Lord Justice Warby's ruling establishes a clean and reusable test: you assess whether data is personal from the controller's perspective, not the attacker's. Tue, 03 Mar 2026 00:00:00 GMTpersonal-data-definitionuk-gdprico-enforcementdsg-retail-rulingdata-protection-lawjigsaw-identificationcompliance-failiureCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/cloud-act-exposure-audit-uk-business-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/cloud-act-exposure-audit-uk-business-2026/In early 2026, the FBI served Microsoft with a search warrant. Microsoft handed over the BitLocker encryption keys for three laptops. No hack. No breach. No compromised passwords. Just a warrant, and Microsoft's compliance. Here is what nobody in UK small business is talking about: those same default settings that allowed this are almost certainly running on your devices right now. And the legal mechanism that made it possible, the US CLOUD Act, reaches across the Atlantic directly into your MicSun, 01 Mar 2026 00:00:00 GMTus-cloud-actuk-businessdata-sovereigntycompliance-failurevendor-risk2026-threatssmb-securityCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/the-cloud-act-and-your-uk-business-the-unquantified-legal-risk-nobody-is-testing/https://thesmallbusinesscybersecurityguy.co.uk/blog/the-cloud-act-and-your-uk-business-the-unquantified-legal-risk-nobody-is-testing/The US CLOUD Act gives American courts the power to compel any US technology company to hand over your data, regardless of whether it sits in a London data centre or a bunker in Wyoming. UK GDPR Article 48 says foreign court orders do not make that transfer lawful. No UK court has tested this conflict. No ICO enforcement action has targeted it. The NCSC does not mention it by name. Corrine Jefferson, our resident intelligence analyst, dissects the legal contradiction sitting quietly in the middlTue, 24 Feb 2026 00:00:00 GMTus-cloud-actuk-businessdata-sovereigntycompliance-failurevendor-risk2026-threatssmb-securityCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/palantir-uk-contracts-data-sovereignty-risk-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/palantir-uk-contracts-data-sovereignty-risk-2026/I used to work in US government intelligence. I now live in London. Those two facts make me uniquely uncomfortable about Palantir's expanding presence across the British state. In December 2024, Switzerland's military concluded that data held by Palantir could be accessed by the American government and that leaks "cannot be technically prevented." Their recommendation was unambiguous: find alternatives. The UK's response to the same evidence has been to award Palantir more than £900 million in cTue, 17 Feb 2026 00:00:00 GMTdata-sovereigntyvendor-riskus-cloud-actuk-businessgovernment-contractssupply-chain-riskcompliance-failureCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/nation-state-vpn-edge-device-attacks-uk-business-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/nation-state-vpn-edge-device-attacks-uk-business-2026/I live in London. I used to work in US government intelligence. And when Google Threat Intelligence Group published their defence industrial base report on 10 February, I did what any former analyst does: I stopped reading the headlines and started reading the primary source. The findings are precise and they are uncomfortable. Chinese state-sponsored actors have exploited more than two dozen zero-day vulnerabilities in edge devices from ten different vendors since 2020. Average dwell time insidTue, 10 Feb 2026 00:00:00 GMTCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/cisa-acting-director-chatgpt-government-data-breach-2026/https://thesmallbusinesscybersecurityguy.co.uk/blog/cisa-acting-director-chatgpt-government-data-breach-2026/The reality is this: the acting director of America's civilian cybersecurity agency uploaded sensitive government contracting documents to ChatGPT's public platform. Multiple automated alerts were triggered. A Department of Homeland Security investigation was launched. And somehow, this still happened. From my former life in government service, I can tell you this isn't just embarrassing. It's a systems failure that reveals fundamental problems with how we approach privileged access, AI governanFri, 30 Jan 2026 00:00:00 GMTgovernment-securityai-security-riskscisadata-protectioninsider-threatus-cybersecurityintelligence-analysisCorrine Jeffersonhttps://thesmallbusinesscybersecurityguy.co.uk/blog/slopocalypse-insecure-iphone-apps-leaking-data/https://thesmallbusinesscybersecurityguy.co.uk/blog/slopocalypse-insecure-iphone-apps-leaking-data/The Apple App Store feels safe. That is the story many people tell themselves. Firehound and Vulnu show why that comfort can be dangerous. Researchers have flagged this week insecure iPhone apps that expose user data through badly secured cloud storage. Some leak private chats, email addresses, and location traces. Many of these apps look polished and carry strong ratings. That is the trap. In this guest post, Corrine Jefferson explains how slop apps slip through review, why AI apps raise the stWed, 21 Jan 2026 00:00:00 GMTApple App StoreiPhone Securitymobile app securitydata leakscloud misconfigurationAI appsprivacycyber securityUK SMBFirehoundapp reviewCorrine Jefferson