If your infrastructure control plane answers from the open network, this week's disclosures are about you.
The Hacker News reported a critical flaw in Canonical's LXD and MicroCloud, rated CVSS 10.0. An attacker could log in as a trusted client without holding that client's private key, and all it took was network reach to the HTTPS API. Unit 42 published a threat brief on critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619, updated October 29. CISA added CVE-2026-118527 in Ivanti Connect Secure to its known exploited list. It is a predictable-identifier flaw that lets a remote authenticated attacker upload attacker-controlled files to a known location on disk.
The pattern is the same in all three. The weak point is not the application but the thing that administers it, and "authenticated" turns out to be a lower bar than the trust model assumed. Reachability is the control you actually own. An endpoint that nothing outside your network can open is not vulnerable to a network-reachable flaw, whatever its score.
We do security review of payment and account flows, including which management and admin endpoints are exposed and what proves identity to them. Rotating that trust material is part of it, including what doing it actually requires. We tell you cost and timeline within a day, and a small scoped review takes days, not months.
If you run container hosts or a remote-access gateway, you probably want a current list of which management APIs are reachable from outside, and a name for who can rotate their certificates today.