Hardcoded Passwords and Hijacked Websites: What UK Small Businesses Need to Know This Week
Two critical vulnerabilities disclosed in the last 48 hours. Both are exploitable by unauthenticated attackers. Both have patches available. The only variable is whether you apply them before someone else acts first.
This is not a theoretical risk assessment. This is an operational briefing.
CVE-2026-111998: The Password That Was Never a Secret
On the 18th of October 2026, the National Vulnerability Database published CVE-2026-111998, a flaw in Vanus versions 0.8.0 through 0.9.0. It carries a CVSS score of 9.8 out of 10. That score is not an abstraction. It reflects a specific and measurable reality: an unauthenticated remote attacker can send a fixed, hardcoded Bearer token to the gateway gRPC proxy port and immediately gain cluster-admin access.
No password guessing. No phishing campaign. No sophisticated tradecraft. The credential was shipped inside the software itself, which means it has been public since the moment anyone downloaded it.
With cluster-admin access, an attacker can manage namespaces, eventbuses, users, tokens, and role bindings. They can read or publish events. In practical terms, they have administrative control over the affected environment.
The implication for small businesses is direct. If you run Vanus 0.8.0 or 0.9.0 in any part of your infrastructure, whether self-hosted or managed by a third party, that environment is compromised in the technical sense of the word until you patch it. The attacker does not need to find you. They can scan for exposed gRPC proxy ports and the rest is scripted.
What to do: Check immediately whether your environment includes Vanus 0.8.0 or 0.9.0. If it does, treat it as a priority-one remediation. Apply the vendor patch. If you use a managed service provider and Vanus is part of your stack, contact them today and ask for written confirmation of patching status. If they cannot provide it, that is a problem worth escalating.
Drupal: Two Critical RCE Vulnerabilities, Exploits Expected Within Days
Also disclosed this week: Drupal’s security team issued warnings for two critical remote code execution vulnerabilities present in all supported versions of the content management system.
The first, CVE-2026-108097, is located in Drupal core’s Field UI module. While the developers note it is not directly exploitable within Drupal core alone, they explicitly warn that exploit paths exist in combination with other modules, and that it is accessible to unauthenticated attackers. That qualification about core exploitability is not reassurance. Any Drupal installation running additional modules, which is to say virtually every real-world Drupal site, should treat this as directly relevant.
Drupal’s advisory is unambiguous: patches are available, and exploits could appear within hours or days of the disclosure. That is not standard vendor caution. That is an operational warning.
For UK small businesses, the question is straightforward. Does your website run on Drupal? If you do not know, find out today. Your web developer, your hosting provider, or your MSP should be able to tell you immediately. If they cannot, that is also a problem worth naming.
What to do: If your site runs Drupal, apply the available patches now. Do not schedule this for the next sprint. Do not wait for your monthly maintenance window. The disclosure timeline and the vendor’s own warning language make this a same-day task. If you use a managed hosting provider, contact them to confirm the patch has been applied and ask for written confirmation.
The Pattern Behind Both Vulnerabilities
Look at these two disclosures together and the pattern is consistent.
In both cases, the vulnerability exists because software was shipped in an insecure default state. Vanus shipped with a credential that was never a credential: it was a fixed string that any attacker could use. Drupal shipped with code containing logic flaws that allow remote code execution.
In both cases, the vendor has issued a patch. That patch does not apply itself.
The risk now sits entirely with any organisation that has not updated. The vendor’s liability ends at disclosure. Yours begins the moment you are informed and do not act.
This is the mundane reality of vulnerability management that the industry’s marketing materials rarely capture: most breaches do not involve sophisticated zero-day exploits. They involve known vulnerabilities for which patches exist, applied to organisations that did not act in time.
How to Turn This Into a Competitive Advantage
Clients and procurement contacts increasingly ask about patching processes during due diligence. Being able to demonstrate a defined, documented patch management procedure, with evidence that critical vulnerabilities are addressed within 24 to 48 hours, is a concrete differentiator.
It is also a Cyber Essentials requirement. The scheme mandates that high-risk patches are applied within 14 days. For CVSS 9.8 vulnerabilities with active exploitation expected imminently, 14 days is the outer boundary, not the target. Treating same-day patching of critical disclosures as standard practice puts you ahead of the baseline and gives you something verifiable to show clients who ask.
If you are in a supply chain relationship with a larger organisation, your patching posture is part of their risk model. The business case for fast patch cycles is not abstract. It is demonstrable and auditable.
Making the Business Case
Three arguments for the decision-maker in the room.
The cost of not patching is quantifiable. A compromised Vanus cluster means an attacker with administrative access to your infrastructure. A compromised Drupal site means the potential for data theft, defacement, or deployment of malware that affects your visitors. The ICO takes a dim view of preventable breaches. GDPR fines for failures of basic hygiene are not hypothetical.
Patches are free. Incident response is not. Both vendors have released fixes at no charge. The cost of applying them is measured in hours of IT time. The cost of a breach investigation, customer notification, regulatory engagement, and reputational damage is not.
The regulator’s guidance is unambiguous. The NCSC’s Cyber Essentials scheme requires timely patching of critical vulnerabilities. The NCSC also publishes specific guidance on vulnerability management. Following published government guidance is a defensible position. Not following it, when a breach occurs, is not.
What to Do Before the End of the Week
-
Audit your Vanus version. If you are running Vanus 0.8.0 or 0.9.0, apply the patch immediately. If you do not know whether Vanus is in your environment, ask your MSP or infrastructure team today. Get the answer in writing.
-
Check your Drupal version. Log in to your Drupal admin panel and verify the version. Cross-reference against the Drupal security advisory. If you are on a supported version, update to the patched release. If you are on an unsupported version, you have a broader problem: unsupported software receives no security fixes and every vulnerability becomes permanent.
-
Contact your MSP or hosting provider. Do not assume they have already applied these patches. Ask directly. Request written confirmation. A managed service provider who cannot tell you within hours whether a CVSS 9.8 vulnerability has been remediated on your systems is not doing the job you are paying for.
-
Review your patch management policy. If you do not have one, create one. It does not need to be complex. It needs to define: who is responsible for monitoring vulnerability disclosures, what the response time is for critical patches, and how confirmation of patching is documented. The NCSC publishes free guidance on exactly this.
-
Log the action. Whatever you do this week, write it down. Date it. Note who did it. If you face a regulatory inquiry or a client audit in the future, demonstrable evidence that you responded promptly to a critical disclosure is the difference between an organisation with a defensible posture and one that cannot account for its own infrastructure.
Before you go: if the podcast version of this briefing was useful, follow the show wherever you listen. Leave a rating or a review if you have a moment; it makes a genuine difference to how the show is found by people who need it. Drop a comment with your thoughts, and if someone in your network runs a small business and would benefit from this kind of intelligence, share it with them directly.