Apple Actively Exploited, Consumer Routers Wide Open, and Russian Hackers in Your Phone: What UK Small Businesses Need to Know Today
Three stories from the last 24 hours. Each one touches something a UK small business almost certainly has in its environment. The Apple item is the highest priority: CISA confirmed active exploitation yesterday, which means attacks are happening now, not in a theoretical future.
The router cluster is the story most likely to be ignored. It shouldn’t be. And the APT29 mobile campaign ties directly to the Apple KEV entry in ways that matter beyond the nation-state framing.
Let’s work through each one.
Story One: Apple’s Authentication Bypass Is Being Actively Exploited Right Now
On the 4th of November 2026, CISA added CVE-2024-27834 to the Known Exploited Vulnerabilities catalogue. That list exists for one reason: confirmed, active, real-world exploitation. Not proof-of-concept. Not theoretical. Active.
The vulnerability is an improper authentication flaw affecting a wide range of Apple products: iOS, iPadOS, macOS, Safari, tvOS and watchOS. The technical description is specific: an attacker who already has arbitrary read and write capability can use this flaw to bypass pointer authentication. Pointer authentication is a hardware-level defence Apple uses to protect against certain classes of memory corruption attacks. Bypassing it is significant because it removes a layer of protection that is otherwise quite robust.
In plain terms: if an attacker has found another way into your device, this vulnerability helps them go further and do more damage than they otherwise could. It is a capability multiplier.
This matters for UK small businesses because the attack chain doesn’t start with this CVE. It starts with a compromised website, a malicious link in an email, or a watering hole. This vulnerability is what gets used once initial access is established. Which brings us directly to Story Three.
CISA’s required action is unambiguous: apply mitigations in accordance with vendor instructions. Apple has issued patches. The fix is available. The only question is whether your devices have received it.
If your team uses Apple devices for business, including personal devices that access business email, cloud storage or customer systems, this is today’s first task. Check Settings, go to General, go to Software Update. If there’s an update available, install it.
Story Two: Nine Consumer Routers, CVSS 10.0, Public Exploits, Vendor Silence
Overnight, the National Vulnerability Database published nine vulnerabilities across consumer-grade routers. All scored at or above CVSS 9.1. Five scored a perfect 10.0. These are not edge cases.
The affected devices span several brands commonly found in small business environments:
Linksys E5600 (CVE-2026-121615, CVSS 10.0): The login handler in the mesh_login.cgi component has an improper authentication vulnerability that can be exploited remotely. This device is flagged as end-of-life, meaning no patch is coming. The vendor was notified and did not respond.
Linksys E5350 (CVE-2026-121932 and CVE-2026-121933, both CVSS 10.0): The first is an OS command injection flaw in the setup wizard’s ping and traceroute functions. The second allows missing authentication in the same wizard, letting an attacker set the router password without logging in first. Both exploits are public. Neither has a patch.
Linksys WRT54GL (CVE-2026-121930 and CVE-2026-121931, both CVSS 9.1): Command injection in the ping and traceroute diagnostic functions, triggerable remotely. This device is also end-of-life. No patch. Vendor notified, no response.
Qihoo 360 D603-2, D600-2, D606-6 and D706 (CVE-2026-121607, CVSS 10.0): OS command injection in the testspeed_command function, exploitable remotely. Exploits are public. Vendor did not respond.
Qihoo 360 M5 (CVE-2026-121609, CVSS 10.0): Hard-coded credentials in the boot script. Remote exploitation is possible. Exploit is public. Vendor did not respond.
Comfast CF-WR632AX (CVE-2026-122013, CVSS 10.0): Path traversal in the multipart parser, exploitable remotely via filename manipulation. Exploit is public.
Edimax BR-6208AC (CVE-2026-122051, CVSS 10.0): Command injection in the goform/mp component. Remote exploitation confirmed. Exploit is public.
The pattern here is not subtle. Consumer routers with public exploits, end-of-life status, and vendors who either cannot or will not respond. These are not attack vectors that require a sophisticated actor. Automated scanning tools identify exposed routers by model. If your office uses one of these devices, you are exposed.
The specific risk for UK small businesses is straightforward. Many SMBs have office routers that were chosen by cost, never updated, and never reviewed for vulnerabilities. If the router’s admin panel is accessible from the internet, or if it’s reachable from any compromised device on the local network, these exploits become relevant immediately.
The fix for end-of-life devices is replacement. There is no patch coming. For devices with available firmware updates, apply them immediately via the router’s admin interface. If you don’t know the model of your office router, find out today.
Story Three: APT29-Linked Attackers Are Targeting iPhones and Android Devices Through Websites You Trust
Researchers reported on the 4th of November 2026 that a threat actor linked to APT29, the Russian state-aligned group, has been running a large-scale watering hole campaign targeting iOS and Android users. The mechanism is a compromised analytics script from a provider called Plerdy, which was injected into legitimate websites to redirect mobile visitors to attacker-controlled infrastructure.
The campaign uses CVE-2024-27834, which is the same Apple authentication bypass that CISA added to the KEV catalogue on the same day. This is not a coincidence. The KEV addition confirms the exploitation CISA has observed in the wild correlates directly with an active, attributed campaign.
The term “watering hole” describes an attack where the attacker compromises a website their targets are likely to visit, rather than targeting the victims directly. The attacker poisons the well and waits. This is relevant to small businesses because the compromised sites are not criminal forums or suspicious domains. They are legitimate websites. The staff member visiting a supplier’s site, an industry publication, or a government portal could encounter this attack without any warning signs.
On iOS, the campaign exploits vulnerabilities in Safari to steal browser session data and device information. On Android, the approach is different but the outcome is similar: credential and data theft.
For UK small businesses, the practical implication is this: keeping Apple and Android devices updated is not a theoretical best practice. It is the specific, evidence-backed defence against an active, government-linked campaign that is running right now. The KEV entry for CVE-2024-27834 is the confirmation.
If your team visits industry websites, supplier portals, or any external sites on work phones or tablets, this campaign is within your threat profile. It does not require your business to be a named target. It requires visiting a compromised website on an unpatched device.
Why This Gives You an Edge
Most small businesses treat security updates as background noise: something that happens eventually, when convenient, when the device prompts enough times. The intelligence picture this week makes the case for a different posture.
The Apple KEV entry means your insurance provider, your enterprise clients, and any regulated sector supplier you work with will expect evidence that your devices are patched. CISA’s Known Exploited Vulnerabilities catalogue is increasingly referenced in procurement questionnaires and due diligence frameworks. Being able to demonstrate that you act on KEV entries promptly is a differentiator in supplier assessments.
On the router side: identifying and replacing end-of-life network equipment before an incident is the kind of documented action that strengthens both your Cyber Essentials posture and any post-incident regulatory conversation with the ICO. “We identified the risk and acted” is a substantially better position than the alternative.
Businesses that treat today’s vulnerability intelligence as actionable, rather than background noise, are the ones that maintain client confidence when incidents do occur elsewhere in their sector.
Making the Business Case
If you need to put this in front of a decision-maker, here are the specific arguments:
CVE-2024-27834 is on the CISA KEV list. That means confirmed active exploitation, not theoretical risk. The question for the board is not whether this matters; it’s whether your devices are patched. The answer should be verifiable within the hour.
Consumer routers with CVSS 10.0 scores and public exploits are a liability. End-of-life equipment with no patch pathway is not a security risk you can mitigate with awareness training or a firewall rule. Replacement is the only remediation. The cost of a business-grade router is measurable. The cost of a network compromise is not.
APT29 is a government-backed threat actor. The business case is not that you are individually targeted. It is that the campaign is indiscriminate at the initial stage: compromised websites affect any visitor on an unpatched device. The defence is patch management. The cost is a software update.
ICO enforcement considers whether organisations acted on known risks. The NVD and CISA KEV catalogue are publicly available. If your organisation’s devices were compromised via a vulnerability that appeared on these lists before the incident, that is a materially relevant factor in any subsequent data protection investigation.
What to Do Before Friday
-
Update every Apple device in your organisation today. iOS, iPadOS, macOS, watchOS, tvOS. All of them. If your business allows personal devices to access email, cloud storage, or any business system, include those in scope. Settings, General, Software Update. This takes minutes and closes the specific vulnerability CISA confirmed is being actively exploited.
-
Identify your office router model. Check the sticker on the back of the device, or log in to the admin panel. If it is a Linksys E5600, E5350, or WRT54GL; a Qihoo 360 D-series or M5; a Comfast CF-WR632AX; or an Edimax BR-6208AC, it is on this week’s critical vulnerability list. End-of-life models need replacing. Models with available firmware updates need them applied immediately.
-
Check whether your router’s admin panel is accessible from the internet. Type your external IP address into a browser from outside your network, or ask your IT provider. If the router admin page loads, it is externally exposed. It should not be. Disable remote management immediately.
-
Brief your team on the watering hole risk. The practical instruction is simple: keep mobile devices updated and report anything unusual on a work device promptly. You do not need to explain APT29 to your staff. You need them to treat software updates as mandatory, not optional.
-
Document the actions you take. Date-stamp your update verification, your router audit, and any device replacements. This documentation is relevant to Cyber Essentials compliance, insurance assessments, and ICO enquiries. It costs nothing to keep a simple log and it has material value if you ever need to demonstrate due diligence.
Before you go: if this briefing was useful, follow the show wherever you listen, leave a rating or a review, and drop a comment with your thoughts. If you know someone running a small business who should be across this kind of intelligence, send it to them. The briefing is only useful if it reaches the people who need it.