Three things landed this week, and they all point at the same place: admin and management APIs that answer from the open internet. If yours do, go look. The Hacker News reported a critical flaw in Canonical's LXD and MicroCloud, rated CVSS 10.0, that let an attacker log in as a trusted client without holding that client's private key. All they needed was network reach to the HTTPS API. Unit 42 published a threat brief on critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619. And CISA added CVE-2026-118527 in Ivanti Connect Secure to its actively-exploited list: a predictable-identifier flaw that lets a remote authenticated attacker upload attacker-controlled files to a known location on disk.
Patching is the easy half. The harder half is knowing which management endpoints are exposed at all, and which trust certificates still work after you patch. We do security review of payment and account flows and of the infrastructure around them: inventory of exposed APIs, trust and credential rotation, and getting those endpoints behind a private network. A review like this takes days, not months, and we tell you cost and timeline within a day. Message us if you want yours checked.