I am restarting this newsletter with the editions I missed, because the lessons are still costing buyers money. In this edition, three actively exploited zero days hit tools small businesses lean on every day, and CISA gave defenders days, not weeks, to fix them. FortiMail (CVEredacted): a critical flaw in Fortinet's email gateway let attackers run code remotely with no credentials. CISA added it to its Known Exploited Vulnerabilities catalog on Oct 1, with a 3 day patch deadline. Citrix NetScaler (CVEredacted): a SAML authentication zero day in the remote access backbone for countless SMBs, confirmed exploited in the wild. It was the third NetScaler zero day in under a week. CISA deadline, Oct 7. Roundcube Webmail (CVEredacted): a pre authentication SQL injection in the open source webmail many small businesses host themselves. No login required to exploit it. The deal lens: when you acquire a small business, you inherit every piece of infrastructure the previous owner installed, often years ago, often unpatched, and invisible on the balance sheet. A breach in the first 90 days after close can unravel customer trust before onboarding is finished. Cyber diligence is not a checklist item, it is price protection. The executive action, before you sign: 1. Get a full list of internet facing systems, email gateway, VPN, remote access, webmail, with versions. 2. Check the last patch date on each one against the CISA deadlines. 3. Ask who owns patching, by name. If the answer is nobody, price that in. What is sitting unpatched in your target's infrastructure right now? Sources: CISA Known Exploited Vulnerabilities catalog