US authorities added security flaws in widely used developer and remote-support tools, including a software-artifact repository and a remote-access product, to their catalogue of bugs known to be actively exploited. These tools sit deep in the technology supply chain: one builds and stores software components, the other lets support staff control computers remotely.
Flaws in such widely deployed infrastructure are prized by attackers because a single hole can reach many victims at once.
What it means: your business may be exposed through software you never chose but a vendor or contractor uses, such as a remote-support tool. It is fair to ask any IT provider or contractor which remote-access tools they use on your systems and whether they are patched, because their weak link becomes yours.