In the news, in October: two sets of flaws that CISA added to its Known Exploited Vulnerabilities catalog. Two PHP flaws nicknamed php2shell that allow unauthenticated remote code execution, and flaws in Collabora Online and Arista's VeloCloud Orchestrator. Mira and Cal cover what the public sources say, what is not known, and how to find every place PHP hides, patch the internet-facing systems first and check Nextcloud for web shells. Then a vendor story. In October a large IT services company said a subcontractor it uses for development and maintenance had been attacked, and that the subcontractor's legitimate accounts were then used against its customers. Two universities came forward with two very different failures: ransomware on a core platform, reached through a maintenance account, and a leak of personal data affecting about 78,000 people from a vendor's cloud storage that held files from finished work, shared with a partner the university had never been told about. Then the deep dive. A large AI lab filed its S-1 in late October, and its risk factors are more candid than any trust portal. Cal shows how to read a filing for security-relevant facts, how to separate boilerplate from things that already happened, and how to turn dated disclosures into vendor questions on data retention, agents, SBOMs, model withdrawal and incident notice. Theo answers what to ask an AI vendor before approving a tool, and the episode ends with five things to add to your vendor intake. If you run vendor risk management or third-party risk, this episode covers how to read an AI vendor's filing for your risk review, what to ask for in a security questionnaire, how to request and validate an SBOM, how to keep an AI-BOM, and how to handle vulnerability management and patch management when CISA adds exploited flaws to its KEV catalog. It also covers software supply chain security, subcontractor risk and prompt injection in AI agents. 00:00 Cold open, 00:32 Intro, 00:40 In the news, 03:32 The incident, 07:35 Deep dive, 15:25 Practitioner corner, 16:38 Fix it this week, 18:23 Outro. Sources S-1 guide Incident CISA PHP alert CISA KEV News Voices are synthetic; the script is written by the Safeguard team and checked against our published research. Topics: vendor risk management, third-party risk, TPRM, SBOM, AI-BOM, security questionnaire, CISA KEV, CVE-2026-109618, CVE-2026-109619, CVE-2026-110447, CVE-2026-114625, PHP, Nextcloud, patch management, software supply chain security, prompt injection, S-1 filing.
