“Are We Exposed?” What CISOs Need to Know About Their Software Risk

Recent events have once again highlighted the need to quickly answer the question, “Are we exposed?”

We now face threats to businesses and governments from vulnerabilities and compromises in three fundamental components used in software development: Curl, PHP, and LiteLLM.

Curl

When it comes to Curl and its underlying transfer library libcurl, the threat can affect the very foundation of internet data transfer. With libcurl embedded in many enterprise environments – from backend microservices and container runtimes to automated CI/CD pipelines and shell scripts – this vulnerability carries potential systemic risk. The core threat centers on high-severity flaws disclosed in October 2026, notably a high-severity HTTP/2 use-after-free issue (such as CVE-2026-92392) where a malicious upstream server handling an upload can corrupt client-side memory and, under specific conditions, trigger remote code execution or application crashes on the machine initiating the transfer. Because libcurl negotiates HTTP/2 by default for HTTPS URLs when the server supports it and applications rarely inspect what libcurl does under the hood, development stacks and automated deployment pipelines that have not upgraded to a fixed version can remain exposed to hostile external endpoints.

LiteLLM

Regarding LiteLLM, JFrog Security Research detected the problem within 2 hours, and the errant LiteLLM package, version 1.107.0, has already been removed from PyPI. Reflecting the open-source community ecosystem’s continually improving maturation, the package maintainers have already published a report. But from 11:39 to 13:23 UTC on October 21, 2026, software developers, agentic agents, or your build systems could have downloaded that package from PyPI, and affected Docker images remained available until 14:20 UTC. The ripple effect of a compromised package or vulnerable component getting into an environment doesn’t just impact the developers or security team. It also impacts IT Ops and, down the line, auditors. Every change impacts the whole organization. Executives, the business decision makers who determine where to invest and allocate resources, need a way to understand where they sit in this maturity. Do they have complete visibility or not?

PHP

In the case of PHP, two CRITICAL-severity PHP core vulnerabilities (CVE-2026-109618, CVE-2026-109619), were disclosed and referred to publicly as PHP2Shell. The bugs can allow unauthenticated remote code execution and Heartbleed-style memory disclosure in PHP itself, independent of the application running on top of it, according to public advisories.  Within days, news outlets reported on the vulnerabilities, and CISA issued an alert urging organizations to patch immediately, including CNBC and the BBC, CISA.

“Are We Exposed?”

When a CISO wrestles with the question of “Are we exposed?”, their triage process should focus on these key issues:

• Is it really a threat?  
• Where is it being used? 
• What is the business impact? 
• Do I have a reporting or disclosure obligation under rules or standards that apply to my organization, such as those of the U.S. Securities and Exchange Commission (SEC), PCI DSS, or, for product manufacturers, the EU Cyber Resilience Act (CRA)?
• Did we block it?
• How do we fix it?

The CISO’s ability to answer these questions with confidence depends on how well they’ve integrated their tools, people, processes, and security program to provide that visibility and respond quickly to security incidents. The ability to do this, in turn,  is a reflection of the maturity of their overall security program and how well they can protect, monitor, and govern the full gamut of software development operations –  whether it’s on the developer’s workstation, in agentic workflows, or implemented directly by AI coding agents. 

A true assessment of your organization’s abilities to determine your strengths, weaknesses, opportunities, and threats is critical to providing a full 360 view of your risk posture.

Hands-On Assessment Experience

As a CISO, I’ve done these assessments on a number of occasions, for both new deployments and as an ongoing protective measure to help keep the business protected as new threats and vulnerabilities evolve. 

These assessments should be broadly based and take into account business objectives, employee capabilities, workflows, data usage, and the maturity of the infrastructure. Covering these bases should give you an accurate compass of where you are and where you need to improve. 

This should, of course, include your tools, but should not lead to one of the classic mistakes organizations make, which is over-focusing on tools, simply because they’re the easiest thing to measure. The other areas mentioned above are easy to overlook, but extremely important to a realistic assessment, as tools without the right people and processes won’t achieve the objective of protecting your business.

JFrog’s Security Maturity Assessment

Based on JFrog’s experience working with many of the Fortune 100 customers and through the expertise of our in-house security research team, we’ve actually built our own Security Maturity Assessment. It lets organizations self-assess their software supply chain security program maturity across 11 domains, based on their answers. 

I strongly recommend taking a few minutes out of your busy day to complete the questionnaire, as it assesses the strengths, weaknesses, opportunities, and risks in your software development operations and could help you identify where to start when it comes to ensuring you can truly answer the question:  “Are we exposed?” 

Takeaways

The question of “Are we exposed?” can be complicated and difficult to assess, but recent high-profile security incidents don’t give CISOs the luxury of taking days to come up with a reply. Corporate executives and board members need fast, accurate answers.

Having complete visibility into your people, processes, workflows, tools, and dependencies gives you the leverage to protect your business under the pressure of the latest attacks. Take the first step in securing your applications by evaluating your operational maturity with JFrog’s Security Maturity Assessment or speaking with one of our domain experts today.

Note: This blog content is provided for general informational and illustrative purposes. It reflects information available as of the publication date shown below and may not be updated. Examples and outcomes are illustrative; actual results may vary depending on your environment and use case. JFrog makes no representation or warranty that the content is complete, accurate, current, or suitable for your particular circumstances. You are responsible for evaluating the content before relying on it. This blog content does not modify any agreement governing your use of JFrog products or services. Product use remains subject to the applicable JFrog Subscription Agreement or other written agreement between you and JFrog.