Six significant cybersecurity issues surfaced between October 13 and 22, 2026, spanning website software, remote-support tools, network defenses, digital certificates, shared computing infrastructure, and an AI gateway. Several involved active or attempted exploitation before organizations knew to act.
The question for executives is not simply whether a patch exists. It is whether their teams can answer three questions within days: Are we exposed? Are we fixed? Were we already breached?
A company that cannot answer these questions within a few business days has a program gap that will resurface with the next disclosure. The executive briefing below explains each issue simply, identifies the questions leadership should ask, and outlines the steps teams can take to fix, verify, and contain exposure.
What are the six critical security vulnerabilities executives should know?
PHP2Shell (CVE-2026-109618 and CVE-2026-109619). These flaws let an attacker take over a web server without a password. PHP runs roughly 70% of the world’s websites, according to NPR, and attack instructions leaked before a fix was ready. Cloudflare’s CEO told NPR his company saw tens of thousands of exploitation attempts in the first 45 minutes, and that the count has since reached the millions. PHP versions 8.1 and older get no fix and must be upgraded, isolated, or taken offline.
BeyondTrust Remote Support (CVE-2026-102764). Help desks use this tool to take over employee computers remotely. Attackers linked to China exploited the flaw for roughly seven weeks before it was disclosed, meaning organizations could have been compromised long before they knew to look.
Network “front doors”: Ivanti VPN, Palo Alto firewalls, and Cisco email gateway. These systems guard remote access, network perimeters, and email. All three flaws have been exploited in real attacks, not just lab demonstrations, and CISA urged immediate patching. In the Ivanti case, even fully updated devices were taken over.
eMudhra certificate authority. Eight of eMudhra’s certificate signing keys were compromised, the kind of keys that let browsers trust a website as genuine. Exposed since April 2025, they could have enabled convincing fake sites or disguised malware as trusted software. No misuse has been seen, and browsers have blocked the affected keys, though some apps with built-in trust lists may still accept them.
PwnEscape (Linux, CVE-2026-99999). An 18-year-old flaw in shared cloud infrastructure lets one customer peek into, crash, or potentially take over the computer running alongside them. Most organizations will encounter this risk through a cloud or software provider, rather than directly.
LiteLLM AI gateway. This widely used tool connects company software to AI services and is downloaded about 23 million times a week. Attackers used stolen developer credentials to insert credential-stealing malware into an official release, which was available for roughly two hours before it was pulled. Anyone who installed it may have exposed their cloud and AI account keys. It is the second compromise of this tool in 2026.
Three key questions that reveal your readiness
Are we exposed?
Can you find every affected system within a day?
Leadership should be able to list every system the public can reach and every product that contains the affected software, including products run by vendors. During incidents like this, many organizations find vulnerable code buried inside a purchased product they never thought of checking. PHP is a good example, since it is embedded in many products companies buy.
Are we fixed?
Can you patch internet-facing equipment without waiting for a maintenance window?
Speed matters most when attackers are already using a flaw. Leadership should know how quickly the organization can apply emergency fixes to internet-facing equipment, and whether that speed holds up under pressure.
Were we breached?
Patched does not mean clean.
The BeyondTrust case shows attackers can operate inside an environment for about seven weeks before anyone is warned. Someone needs to own checking whether attackers got in before the fix went live, and activity records need to reach back far enough to allow it, ideally two months or more.
Why this goes beyond the security team
These questions land on the CFO, general counsel, and board as much as on IT.
- Vendor contracts: Require vendors and managed service providers to notify you promptly of exposure and tell you when they have fixed it. We suggest hearing back from critical vendors within three days.
- Cyber insurance: Policies typically carry their own notification deadlines. Know them before an incident.
- SEC disclosure: If you have disclosure obligations, you need a clear process to decide quickly whether an incident is material and reportable.
- Board visibility: The board should see how fast the organization finds and fixes problems, not just that a patch was eventually applied.
Get the full briefing
Download the executive briefing for the full breakdown of all six vulnerabilities, including a technical remediation guide for your security team. To talk through where your organization stands, contact CrossCountry today.