This week at a glance
October ended with a cluster of incidents that one TechTarget feature calls Black October. The PHP2Shell flaws in PHP itself, a use-after-free in the curl library that sits inside pipelines and containers, and a compromised release of the LiteLLM AI gateway on PyPI all landed within days of each other. Each one triggered the same boardroom question, and JFrog Field CISO Paul Davis sets out the six triage questions a CISO has to answer quickly: is it really a threat, where is it used, what is the business impact, do we have a disclosure duty, did we block it, and how do we fix it. The insurance market is watching: AM Best calls PHP2Shell the systemic scenario insurers have long feared and warns liability could reach directors and officers. A new breach study finds the median breach now exposes 542 other organisations.
AI is changing the vulnerability pipeline at both ends. JFrog Security Research documents a surge in CVE volume, a maintainer community overwhelmed by AI-generated reports, and one account whose 55 advisories turned out to be 54 fabrications. A CISO interviewed by Help Net Security argues that patching faster is necessary but not a strategy, and an opinion piece urges boards to stop counting vulnerabilities and measure risk removed instead.
At ISC2 Security Congress in Denver, Nvidia’s Mark Weatherford described the CISO’s new role as business-risk translator, ISC2 launched a coalition to define AI security jobs, and a cyber-legal expert offered three frameworks for defending AI decisions in court. AI suppliers are now disclosing their own risks: Anthropic’s IPO filing lists misuse, liability and safeguard gaps, and Anthropic and OpenAI disagree on who should be able to shut down a dangerous model. Boards, meanwhile, are still waiting for a return: Gartner says only 3% of organisations have hit their AI productivity targets. On policy, the UK budget promises a consultation on making software makers liable for insecure products, CISA published its 2030 plan and NIST set out its post-quantum transition.
On our watch list
- The UK Cyber Security and Resilience Bill’s Lords third reading on Monday, 2 November. No amendments had been tabled ahead of the final Lords stage. Once it clears, essential-service operators and their suppliers face updated incident-reporting duties and new government direction powers; watch for commencement dates and secondary rules.
- Whether PHP2Shell becomes a long-tail insurance event. CyberCube says the near-term catastrophe may have been avoided but the crisis could develop slowly. Renewal questionnaires and any new wording on systemic events or D&O exposure over the next two quarters will show how underwriters price it.
- How the UK frames software liability. The budget promises a consultation “next year” on tackling insecure technology at source, and the Law Commission’s proposal to treat software and AI as products under the Consumer Protection Act is open until 14 January. If you sell software into the UK, watch whether liability follows the EU Cyber Resilience Act model.
- What ISC2’s Cyber-AI Workforce Coalition produces. Its first meeting is this month and the first free toolkits for defining AI security roles are due in spring 2027. Those definitions may become the template HR teams use to write your next AI security job descriptions.
- CISA’s 60-day and 180-day milestones. The 2030 plan starts a review of core services within 60 days and promises an implementation plan with success metrics within 180 days. Which services survive the review matters to any organisation that relies on CISA alerts, assessments or regional field staff.
- Whether more open-source projects shorten disclosure windows. GNOME cut its disclosure deadline from 90 days to 30 days under the weight of AI-generated reports, and NIST has deprioritised much of the NVD backlog. More projects following suit would leave security teams less time and less enrichment data to triage each new CVE.
- The next “Are we exposed?” moment. The compromised LiteLLM release was live on PyPI for under two hours. The next package compromise will test how quickly your team can say whether a build, a developer or an AI agent pulled it in.
- How AI suppliers’ risk disclosures evolve. Anthropic’s filing admits its safeguards may prove inadequate and that misuse could bring liability. As more AI vendors face public-market disclosure, their risk factors become a ready-made checklist for your own third-party reviews.
- Where the “shutdown controls” debate lands. Anthropic wants courts able to suspend dangerous models; OpenAI wants developers required to maintain multiple shutdown controls. Whichever model prevails is likely to shape what enterprises are expected to have for their own deployed agents.
- Whether AI budgets tighten in 2027 planning. Gartner says 38% of organisations are over budget on AI and 85% still plan to spend more. Watch whether finance teams start tracking token spend as a line item, and whether attackers start targeting it: Gartner predicts cost-exhaustion attacks against 80% of organisations with public-facing AI by 2030.
- Post-quantum deadlines flowing to suppliers. US federal high-value systems must move key establishment to post-quantum cryptography by 2030 and signatures by 2031. Expect contract clauses and procurement questionnaires to start asking vendors for their own migration plans.
This week’s topic map — the CISO and the board joined by the “Are we exposed?” triage question, fed by PHP2Shell, the curl flaw, the LiteLLM compromise and the AI-driven CVE surge, with JFrog’s maturity assessment and disclosure duties alongside; Black October and the insurers tie PHP2Shell to D&O exposure; ISC2’s congress links the business-risk translator role, AI liability evidence and the workforce coalition; Anthropic and OpenAI sit on the AI supplier-risk axis; Gartner anchors the AI value gap; UK liability, the UK bill, CISA 2030 and NIST’s post-quantum roadmap ring the policy edge.
View interactive topic map →
Article index
Are we exposed? Software risk and the patch clock
Our own field CISO’s triage questions lead, followed by how AI is flooding the CVE pipeline, why faster patching is not enough, how to measure risk removed, and the Black October incidents that tested it all.
The CISO’s evolving brief
ISC2 Security Congress recasts the CISO as business-risk translator, launches an AI workforce coalition and offers frameworks for AI liability; a global CISO and a two-part essay on where security should report.
AI suppliers, agents and accountability
An AI lab’s IPO filing lists its security risks, two labs disagree on who should pull the plug, and two longer reads on AI vendor failure and reconstructing agent decisions.
The AI bill
Boards expect AI savings that few have seen, costs hide outside the budget line, and Gartner predicts insurers will set AI governance and attackers will target AI spend.
Policy and standards
The UK moves toward software liability and finishes Lords scrutiny of its cyber bill; CISA publishes its 2030 plan and NIST its post-quantum transition roadmap.
Detailed write-ups
1. “Are we exposed?”: the six questions a CISO must answer fast
JFrog · Help Net Security · Infosecurity Magazine · October 27–30, 2026
In a post published on Thursday, JFrog Field CISO Paul Davis starts from the question every board asked this month. Three components that sit deep inside modern software were hit within days of each other. The curl library, embedded in microservices, container runtimes, CI/CD pipelines and scripts, disclosed a high-severity HTTP/2 use-after-free in which a malicious server handling an upload can corrupt client memory and, under some conditions, run code. A malicious LiteLLM release, version 1.107.0, sat on PyPI from 11:39 to 13:23 UTC on 21 October, with affected Docker images available until 14:20; JFrog Security Research detected it within two hours. And the two critical PHP core flaws known as PHP2Shell allow unauthenticated remote code execution and memory disclosure regardless of the application running on top.
Davis sets out the triage a CISO has to run: Is it really a threat? Where is it being used? What is the business impact? Is there a reporting or disclosure obligation, under SEC rules, PCI DSS or, for product makers, the EU Cyber Resilience Act? Did we block it? How do we fix it? How confidently those questions can be answered depends on the maturity of the whole programme, across developer workstations, agentic workflows and AI coding agents, and he warns against the classic mistake of over-weighting tools simply because they are the easiest thing to measure. JFrog’s Security Maturity Assessment lets organisations self-assess across 11 domains of software supply chain security. “Corporate executives and board members need fast, accurate answers,” he writes.
The inputs to that triage are getting noisier. JFrog Security Research reports a sharp rise in CVE volume driven by AI on both sides: skilled researchers find more, and low-skill submitters flood the system. The curl project ended its bug bounty in January after the confirmed share of reports fell below 5%; GNOME cut its disclosure deadline from 90 days to 30; and NIST now prioritises known-exploited and critical software in the NVD, leaving older backlog “Not Scheduled”. In one case JFrog examined, a newly created account published 55 advisories with scores up to 9.8; 54 were fabricated, citing functions that do not exist and, in one case, line 3,555 of a 2,706-line file.
Two practitioners add the remediation side. Bellini Capital CISO Brian Blakley tells Help Net Security that defenders still have to assess impact, validate and schedule every fix, so reducing exposure through segmentation, isolation and compensating controls matters as much as speed: “‘Patch faster’ is necessary but it’s insufficient as a long-term strategy.” In a vendor-authored opinion piece, Filigran’s Neena Sharma proposes replacing vulnerability counts with measures such as retest failure rate, attack paths removed and control effectiveness, tested against one question: “It’s whether the organization is harder to attack as a result.”
Sources: JFrog (“Are We Exposed?” What CISOs Need to Know Ab…) · JFrog (The Impact of AI on CVEs: Industry Challenge…) · Help Net Security (Bellini Capital CISO on AI security governan…) · Infosecurity Magazine (Stop Counting Vulnerabilities and Start Meas…)
2. Black October: the month the patch clock ran out
TechTarget · Cybersecurity Dive · CSO Online · October 27–30, 2026
TechTarget’s Sharon Shea gives the month a name. The most intense stretch ran from 19 to 23 October, during Cybersecurity Awareness Month: PHP2Shell sent organisations scrambling to take sites offline, alongside a flaw in a widely used DevOps platform, the LiteLLM third-party compromise and an identity-driven attack on a remote-management tool. Several of the flaws had sat in code for years; what changed is how fast they were found and weaponised. BDO’s Fred Rica says exploit development that took days or weeks now happens at machine speed. “It’s the same risks, but at a far greater speed,” said Optiv CISO Rob Gregory.
The insurance market is drawing its own conclusions. Cybersecurity Dive’s David Jones reports that AM Best called PHP2Shell the systemic-risk scenario that has long worried cyber insurers and kept them from expanding their risk models aggressively. PHP runs more than 70% of websites, and CISA has added both flaws to its Known Exploited Vulnerabilities catalog. AM Best warns that liability could reach directors and officers, while CyberCube called the event a “watershed moment” that may have avoided a near-term catastrophe only to become a long-tail event. Impact so far is limited largely because so many sites disconnected. “We’ve never seen a true 1-in-200-year cyber catastrophe, but in theory the market is well capitalized for one,” said CyberCube’s William Altman.
A separate study shows why someone else’s breach is now your problem. Lab 1’s analysis of 328 million files across 2,089 breached datasets, reported by CSO’s John Leyden, found the median breach in 2026 exposed 542 organisations beyond the initial victim, up from 482, and the median breach grew 122% to 29.8GB. About 44% of files held financial data and private cryptographic keys turned up in roughly 15% of incidents. Lab 1 identified seven criminal groups doing structured analysis of stolen data, and the first “indexing-as-a-service” offering appeared in March. For a CISO the implication is that supplier and customer breaches belong in your own incident playbook, with a plan for what to rotate and whom to notify when your data appears in someone else’s leak.
Sources: TechTarget (Why Black October signals a new era of cyber…) · Cybersecurity Dive (Insurance industry fears potential impacts f…) · CSO Online (The days of assuming another company's breac…)
3. ISC2 Security Congress: from gatekeeper to business-risk translator
Infosecurity Magazine · Dark Reading · CIO · October 27–29, 2026
Speaking at ISC2 Security Congress in Denver on 26 October, Nvidia’s head of cybersecurity policy Mark Weatherford argued that AI has moved the CISO from security gatekeeper to business-risk translator. He described a board that questioned whether its CISO understood the company’s business model at all. CISOs rarely own the business risk of deploying AI, he said, but they must make sure leaders know who does, and they have to cover both security for AI and AI for security. His advice: write short plans that state the risk reduction proposed and the resources needed, track supply-chain dependencies several tiers down, and learn one new AI topic a week, such as MCP, prompt injection or sandboxing. “If you’re not doing pentesting 24/7, 365, you’re probably behind the curve,” he said.
ISC2 used the congress to explain its Cyber-AI Workforce Coalition, announced on 20 October. Chief executive Scott Beale says it will bring together HR managers, CISOs, employers, standards bodies and government, meet for the first time this month and deliver free toolkits for defining AI security roles by spring 2027, rather than new standards. Dark Reading covered cyber-legal expert Daniel B. Garrie’s three frameworks for AI liability: a five-factor AI deployment risk score (potential harm, data and rights, autonomy, evidence gap and vendor dependence) that sorts a tool into standard review, conditional approval, restricted pilot or hold release; a structured record of each board decision, including the conditions, human approvals and challenges raised; and an AI incident checklist that preserves the system’s state and chain of custody. He urges CISOs to negotiate log access and model snapshots into vendor contracts, because regulators and litigators will judge the evidence. “They don’t care that you’re using the NIST guidelines,” he said.
Two pieces show what translation looks like in practice. Sedgwick’s global CISO Eric Schmitt tells Infosecurity Magazine that his in-house, 24/7 SOC patched a multi-data-centre Citrix estate in about three hours from pre-built playbooks, and that automated containment twice isolated a country’s network on what proved to be false positives, with the chief executive backing the call: “it’s better to stop the attack than to take damage while you investigate.” He frames risk in financial terms for the CFO and operational terms for the COO. In a two-part CIO opinion series, Marquette University’s Steven Goodman notes that 64% of CISOs report into IT and only 10% influence financial decisions, and argues security should report to the CEO or a board committee, as internal audit does, and own AI governance.
Sources: Infosecurity Magazine (AI Is Turning CISOs Into Business-Risk Trans…) · Infosecurity Magazine (ISC2 Launches Cyber-AI Workforce Coalition t…) · Dark Reading (3 Frameworks to Protect CISOs & Orgs Against…) · Infosecurity Magazine (How Sedgwick's Global CISO Builds Cyber Resi…) · CIO (The moat is dry – Part 1: Why the old securi…) · CIO (The moat is dry – Part 2: A roadmap for rebu…)
4. Your AI supplier’s risks are now on the record
CyberScoop · CSO Online · CIO · October 27–29, 2026
Anthropic’s IPO filing gives security leaders an unusually candid list of what an AI supplier worries about, CyberScoop’s Derek B. Johnson reports. Attacks carried out with Claude or AI agents could cause financial loss, legal exposure and physical harm, and could make insurance harder to buy. The company expects foreign governments and criminal groups to push harder for access to its frontier models, says actual or perceived misuse could bring liability and reputational damage, and notes that researchers using Claude for authorised bug hunting could face legal risk. It flags that agents connected to many tools, databases and APIs create new attack surfaces, that Europe’s breach-reporting deadlines may be hard to meet, and that its safeguards may prove inadequate; it has proceeded with projects despite known gaps. It also discloses export controls on two of its models and a federal civil investigative demand.
The two leading labs also disagree on the off switch. CSO’s Gyana Swain reports that in submissions to California, Anthropic proposed that courts be able to suspend dangerous models, with risk reports at least every six months and a pooled fund for independent evaluators, describing “circuit breakers” at the agent, customer, deployment or model level. OpenAI rejects a single kill switch and wants developers legally required to maintain “shutdown controls”, with annual compliance audits; it notes that nobody can reliably shut down independently run copies of open-weight models.
Two CIO pieces turn this into supplier management. Grant Gross expects a shakeout among hundreds of AI start-ups and advises contracts that guarantee export of prompts, outputs and fine-tuning data, notice periods, data return and deletion, and penalty-free exit on acquisition, plus a plan to revalidate workflows if you must switch models: “Assume your AI vendor will get bought or go under, and plan for it now.” In an opinion piece, Maman Ibrahim argues that agent audit logs record events but not reasons, and proposes capturing what an agent knew, the basis for its choice, who authorised it and what changed. “Logs capture events. Accountability requires decisions that can be rebuilt after the fact.”
Sources: CyberScoop (All the security risks Anthropic is worried…) · CSO Online (Anthropic and OpenAI diverge on who should p…) · CIO (When your AI vendor goes belly up) · CIO (Your AI agents have audit logs. Can you reco…)
5. The AI value gap reaches the boardroom
The Register · TechTarget · October 27–29, 2026
Three-quarters of board members expect AI to deliver productivity gains and cost savings, but only 3% of organisations have hit their targets, Gartner told its HR Symposium, as reported by The Register. Thirty-eight per cent are over budget on AI and 85% plan to spend more next year; only about one in five employees has had time freed up. “Ultimately, organizations will not generate cost savings from AI at this point,” said Gartner’s CV Viverito.
TechTarget’s coverage fills in why. Citing Workday, Richard Livingston reports that about 40% of the time AI saves is spent fixing its output, and citing Deloitte, that only 6% of organisations see measurable ROI and payback can take four years. Some large technology firms have restricted employee use of certain AI tools over data concerns. His argument is that CISOs cannot follow the retreat: attackers are using AI for reconnaissance, phishing and malware, so security teams should measure their own AI by detection and response times, false positives and containment. A second piece lists the costs budgets miss: experimentation, workflow redesign, training, data clean-up, token consumption that was not a CFO line item a year ago, and the expense of reviewing AI output.
Gartner’s strategic predictions, presented at its Orlando symposium, carry several items for security leaders. By 2030, 80% of organisations with public-facing AI will face attacks designed to run up their AI costs, so token consumption should be monitored as a security signal. Insurers, not regulators, will shape AI governance through underwriting standards. By 2029, 80% of new applications will be built to last less than a year, opening new security gaps, and 60% of organisations will create a function to tie AI spend to value. On agents, Gartner’s Daryl Plummer was blunt: “Do not allow agents to act as a mob.”
Sources: The Register (A whopping 3% of boardroom execs spy product…) · TechTarget (Some businesses are pulling back from AI. CI…) · TechTarget (IT leaders reveal the hidden costs of AI ado…) · TechTarget (Gartner presents its top strategic predictio…)
6. The UK edges toward software liability
The Record · UK Parliament · October 28–30, 2026
One bullet point in a 166-page UK budget document could matter a great deal to anyone who ships software. The government “will consult next year on how to tackle insecure technology at source”, The Record’s Alexander Martin reports, meaning how to hold technology companies liable for breaches caused by insecure products. A Law Commission consultation, open until 14 January, already proposes extending the definition of “product” in the Consumer Protection Act 1987 to software and AI systems. Officials may also extend the PSTI Act, which has set security rules for consumer smart devices since 2024, and want any new regime to stay compatible with the EU’s; the Cyber Resilience Act allows fines of up to €15 million or 2.5% of global turnover, with its main obligations applying from December 2027. A 2025 cyberattack on a UK manufacturer is estimated to have cost the British economy £1.9 billion, and the Business Software Alliance has lobbied against liability measures. “The reality is that in 2025, we know how to build secure products and services,” NCSC chief technology officer Ollie Whitehouse has written.
The budget also commits £154 million to cyber defence, including £70 million for a National Exposure and Real-Time Vulnerability Centre at the NCSC and £40 million for a National Agentic Security Unit. Separately, the Cyber Security and Resilience Bill reaches its Lords third reading on Monday, 2 November, after report stage on 26 October; no amendments had been tabled. The bill covers essential services such as healthcare, water and energy, brings more sectors into scope, updates incident-reporting duties and gives the government powers to direct organisations on national-security grounds. For CISOs at software suppliers, the direction is clear: secure-by-design evidence is turning from good practice into potential legal defence.
Sources: The Record (UK to look at making software companies liab…) · UK Parliament (Lords completes examination of Cyber Securit…)
7. CISA 2030: Defend, Harden, Prevail
Cybersecurity Dive · October 26, 2026
CISA has published a four-year strategy, “CISA 2030: Defend, Harden, Prevail”, Cybersecurity Dive’s Eric Geller reports. It rests on three commitments: basic defence, long-term hardening and systemic resilience to disruption. The agency will begin reviewing its core services and capabilities within 60 days, finish an implementation plan with success metrics within 180 days and report on progress after a year. It plans to build capacity through its ten regional offices, although its field force has shrunk, and is onboarding several hundred new staff to fill vacancies left by earlier cuts. The plan also points to a UK-style National Risk Register to help set priorities for protecting assets. “Resilience must be the foundation of our approach,” said acting director Nick Andersen.
For security leaders the useful signals are the two deadlines. The services review will show which assessments, alerts and regional support remain available, and the metrics in the 180-day plan will show what the agency expects to be judged on. Organisations that lean on CISA’s free services should review what they would do if a given service were cut back.
Sources: Cybersecurity Dive (CISA promises proactive defense in new strat…)
8. NIST maps the post-quantum transition
Nextgov/FCW · October 27, 2026
NIST has issued a report, Transition to Post-Quantum Cryptography Standards (IR 8547), that identifies the quantum-vulnerable algorithms in use and the post-quantum standards meant to replace them, Nextgov/FCW’s Grace Dille reports. NIST published its first post-quantum standards in August 2024. Federal timelines have since tightened: agencies must move high-value assets and high-impact systems to post-quantum key establishment by 2030 and to post-quantum digital signatures by 2031, with full migration due by 2035. The report allows hybrid schemes that pair conventional and post-quantum algorithms, and addresses the risk that adversaries are harvesting encrypted data now to decrypt later. An October GAO report found agencies have not fully identified vulnerable systems or tested quantum-resistant algorithms.
“The report describes different use cases and says why one migration might take longer than another,” said NIST’s Dustin Moody, who leads the standardisation project. For private-sector CISOs, the practical step is the same one agencies are struggling with: a cryptographic inventory. Federal deadlines tend to flow down to suppliers through contracts, and long-lived sensitive data is already exposed to harvest-now attacks.
Sources: Nextgov/FCW (NIST issues roadmap for transition to post-q…)
Calls to action
- Rehearse the six triage questions. Run PHP2Shell, the curl HTTP/2 flaw and the LiteLLM compromise through them as a tabletop: is it a threat, where is it used, what is the impact, what must we disclose, did we block it, how do we fix it. Time each answer.
- Check for the compromised LiteLLM release. Search package caches, build logs and container registries for LiteLLM 1.107.0 and images pulled on 21 October, including anything fetched by AI coding agents.
- Map your disclosure triggers with legal. Write down which events would trigger SEC, PCI DSS or EU Cyber Resilience Act reporting for your organisation, and who decides, before the next Black October.
- Replace vulnerability counts in the board pack. Report attack paths removed, retest failures and time to reduce exposure, and show the compensating controls you use while fixes are pending.
- Verify before you escalate. AI-generated and fabricated advisories are entering feeds with critical scores. Require a reachability or code check on high-severity findings before they trigger an emergency change.
- Score AI deployments and record board decisions. Adopt a simple risk score for each AI tool and minute the board’s decision, conditions and approvals, so you can show what you knew and why you proceeded.
- Put evidence and exit terms into AI contracts. At renewal, ask AI vendors for log access, model-version snapshots after an incident, data export, notice periods and penalty-free exit on acquisition.
- Treat AI spend as a security signal. Rate-limit public-facing AI features and alert on unusual token consumption, so a cost-exhaustion attack shows up before the invoice does.
- Start a cryptographic inventory. List where quantum-vulnerable algorithms protect long-lived sensitive data, and ask key suppliers for their post-quantum migration plans.
Quote of the week
“One AI-generated advisory this month pointed to a bug on line 3,555 of a 2,706-line file. Finally, a vulnerability that can’t be exploited, can’t be patched and still made it into the board report.”
— The Newshunter desk
|