JFrog Urges CISOs to Answer "Are We Exposed?" After Curl, PHP and LiteLLM Incidents

Three components, three different risks

According to JFrog, businesses and governments now face threats from vulnerabilities and compromises in three fundamental components of software development: Curl, PHP and LiteLLM.

Curl. JFrog describes high-severity flaws in Curl and its transfer library libcurl, disclosed in October 2026. It highlights a high-severity HTTP/2 use-after-free issue (such as CVE-2026-92392). In this case, a malicious upstream server handling an upload can corrupt client-side memory. Under specific conditions this can trigger remote code execution or application crashes on the machine starting the transfer. JFrog notes that libcurl negotiates HTTP/2 by default for HTTPS URLs when the server supports it, and that applications rarely inspect what the library does under the hood. Stacks and deployment pipelines that have not moved to a fixed version can therefore remain exposed to hostile external endpoints. The company points out that libcurl is embedded in many enterprise environments, from backend microservices and container runtimes to CI/CD pipelines and shell scripts.

PHP. Two CRITICAL-severity PHP core vulnerabilities (CVE-2026-109618 and CVE-2026-109619) were disclosed and are publicly referred to as PHP2Shell. According to public advisories cited by JFrog, the bugs can allow unauthenticated remote code execution and Heartbleed-style memory disclosure in PHP itself, independent of the application running on top of it. JFrog says news outlets reported on the flaws within days, and CISA issued an alert urging organizations to patch immediately.

LiteLLM. JFrog Security Research detected a problem with LiteLLM package version 1.107.0 within 2 hours, and the package has since been removed from PyPI. The package maintainers have published a report. According to JFrog, from 11:39 to 13:23 UTC on October 21, 2026, developers, agentic agents or build systems could have downloaded the package from PyPI. Affected Docker images remained available until 14:20 UTC.

The CISO's triage questions

JFrog argues that a compromised package or vulnerable component affects more than developers and security teams. It also reaches IT Ops and, later, auditors, so every change touches the whole organization. Executives who decide where to invest need to know whether they have complete visibility.

The post lists the issues a CISO's triage should cover:

• Is it really a threat?
• Where is it being used?
• What is the business impact?
• Is there a reporting or disclosure obligation under rules or standards such as those of the U.S. Securities and Exchange Commission (SEC), PCI DSS or, for product manufacturers, the EU Cyber Resilience Act (CRA)?
• Did we block it?
• How do we fix it?

JFrog says the ability to answer these with confidence depends on how well tools, people, processes and the security program are integrated. It reflects the maturity of a security program and how well an organization can protect, monitor and govern software development, whether on developer workstations, in agentic workflows or when implemented directly by AI coding agents.

Assessments and the tools trap

The author, writing as a CISO who has run such assessments for new deployments and as an ongoing measure, says they should be broadly based. They should consider business objectives, employee capabilities, workflows, data usage and infrastructure maturity. The post warns against a classic mistake: over-focusing on tools simply because they are the easiest thing to measure. In JFrog's view, tools without the right people and processes will not protect the business.

JFrog's Security Maturity Assessment

JFrog says it built its own Security Maturity Assessment based on its work with many Fortune 100 customers and the expertise of its in-house security research team. Organizations can use it to self-assess the maturity of their software supply chain security program across 11 domains, based on their answers. The author recommends completing the questionnaire, saying it assesses strengths, weaknesses, opportunities and risks in software development operations and can show where to start.

The takeaway from JFrog is that recent incidents leave CISOs no room to take days to reply, since executives and board members need fast, accurate answers. The company says complete visibility into people, processes, workflows, tools and dependencies gives security leaders leverage under pressure. It invites readers to take the assessment or speak with its domain experts. As the post itself is vendor content, its framing and product recommendation reflect JFrog's own view.