--- title: “Are We Exposed?” What CISOs Need to Know About Their... description: Three recent incidents in Curl, PHP, and LiteLLM show why CISOs need fast answers to 'are we exposed?'. A high-severity Curl HTTP/2 use-after-free bug... canonical: https://daily.dev/posts/are-we-exposed-what-cisos-need-to-know-about-their-software-risk-gwhipiaxe twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: “Are We Exposed?” What CISOs Need to Know About Their Software Risk | daily.dev og:description: Three recent incidents in Curl, PHP, and LiteLLM show why CISOs need fast answers to 'are we exposed?'. A high-severity Curl HTTP/2 use-after-free bug... og:url: https://daily.dev/posts/are-we-exposed-what-cisos-need-to-know-about-their-software-risk-gwhipiaxe og:image: https://api.daily.dev/og/posts/GwhIPiAXe.png og:image:alt: “Are We Exposed?” What CISOs Need to Know About Their Software Risk og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # “Are We Exposed?” What CISOs Need to Know About Their Software Risk **[JFrog](https://daily.dev/sources/jfrog)** · 6 min read · 0 upvotes · 0 comments ## Summary Three recent incidents in Curl, PHP, and LiteLLM show why CISOs need fast answers to 'are we exposed?'. A high-severity Curl HTTP/2 use-after-free bug (CVE-2026-92392) can let a malicious upstream server corrupt memory and, under specific conditions, trigger remote code execution. A LiteLLM package (version 1.107.0) could have been downloaded from PyPI between 11:39 and 13:23 UTC on October 21, 2026, with affected Docker images available until 14:20 UTC, and JFrog Security Research detected the problem within 2 hours. PHP2Shell (CVE-2026-109618, CVE-2026-109619) can allow unauthenticated RCE and Heartbleed-style memory disclosure, and CISA issued an alert urging organizations to patch immediately. The post lists six triage questions CISOs should ask and points to JFrog's Security Maturity Assessment, covering 11 domains, as a self-assessment tool. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-92392 in Curl and how severe is it? CVE-2026-92392 is a high-severity HTTP/2 use-after-free vulnerability in libcurl, disclosed in October 2026, where a malicious upstream server handling an upload can corrupt client-side memory. Under specific conditions this can trigger remote code execution or crash the application initiating the transfer, since libcurl negotiates HTTP/2 by default for HTTPS when supported. _Teams tracking which services embed libcurl can follow patch guidance for curl CVEs on daily.dev._ ### What happened with the malicious LiteLLM package on PyPI in October 2026? A malicious LiteLLM package, version 1.107.0, was available for download on PyPI from 11:39 to 13:23 UTC on October 21, 2026, and affected Docker images remained available until 14:20 UTC. JFrog Security Research detected the issue within 2 hours, the package was removed, and the maintainers published a public incident report. _Developers auditing AI-tooling dependencies can watch for incident reports like LiteLLM's on daily.dev._ ### What is PHP2Shell and which CVEs does it cover? PHP2Shell refers to two critical-severity vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution and Heartbleed-style memory disclosure independent of the application running on top of PHP. CISA issued an alert urging organizations to patch immediately after public advisories and news coverage from outlets like CNBC and the BBC. _PHP maintainers patching urgent CVEs can track advisories such as PHP2Shell's on daily.dev._ ## Similar posts on daily.dev - [PHP2Shell: Prepare for the Next Vulnerability](https://daily.dev/posts/php2shell-prepare-for-the-next-vulnerability-lewhmq4u1) · Snyk · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#php](https://daily.dev/tags/php), [#supply-chain](https://daily.dev/tags/supply-chain), [#curl](https://daily.dev/tags/curl) [View this post on daily.dev](https://daily.dev/posts/are-we-exposed-what-cisos-need-to-know-about-their-software-risk-gwhipiaxe) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"“Are We Exposed?” What CISOs Need to Know About Their Software Risk","url":"https://daily.dev/posts/are-we-exposed-what-cisos-need-to-know-about-their-software-risk-gwhipiaxe","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/are-we-exposed-what-cisos-need-to-know-about-their-software-risk-gwhipiaxe"},"datePublished":"2026-10-30T20:24:55.305Z","dateModified":"2026-10-30T20:25:28.869Z","description":"Three recent incidents in Curl, PHP, and LiteLLM show why CISOs need fast answers to 'are we exposed?'. A high-severity Curl HTTP/2 use-after-free bug...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d84e1051379ff3bab1f5d303d669bf9f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/d84e1051379ff3bab1f5d303d669bf9f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"JFrog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"JFrog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/b11bf37102384ac9983be701b2cf7cd5","url":"https://daily.dev/sources/jfrog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/are-we-exposed-what-cisos-need-to-know-about-their-software-risk-gwhipiaxe","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,php,supply-chain,curl","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"JFrog","item":"https://daily.dev/sources/jfrog"},{"@type":"ListItem","position":3,"name":"“Are We Exposed?” What CISOs Need to Know About Their Software Risk"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/are-we-exposed-what-cisos-need-to-know-about-their-software-risk-gwhipiaxe#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-92392 in Curl and how severe is it?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-92392 is a high-severity HTTP/2 use-after-free vulnerability in libcurl, disclosed in October 2026, where a malicious upstream server handling an upload can corrupt client-side memory. Under specific conditions this can trigger remote code execution or crash the application initiating the transfer, since libcurl negotiates HTTP/2 by default for HTTPS when supported. Teams tracking which services embed libcurl can follow patch guidance for curl CVEs on daily.dev."}},{"@type":"Question","name":"What happened with the malicious LiteLLM package on PyPI in October 2026?","acceptedAnswer":{"@type":"Answer","text":"A malicious LiteLLM package, version 1.107.0, was available for download on PyPI from 11:39 to 13:23 UTC on October 21, 2026, and affected Docker images remained available until 14:20 UTC. JFrog Security Research detected the issue within 2 hours, the package was removed, and the maintainers published a public incident report. Developers auditing AI-tooling dependencies can watch for incident reports like LiteLLM's on daily.dev."}},{"@type":"Question","name":"What is PHP2Shell and which CVEs does it cover?","acceptedAnswer":{"@type":"Answer","text":"PHP2Shell refers to two critical-severity vulnerabilities in PHP core, CVE-2026-109618 and CVE-2026-109619, which can allow unauthenticated remote code execution and Heartbleed-style memory disclosure independent of the application running on top of PHP. CISA issued an alert urging organizations to patch immediately after public advisories and news coverage from outlets like CNBC and the BBC. PHP maintainers patching urgent CVEs can track advisories such as PHP2Shell's on daily.dev."}}]} ```