Black October: Five Questions Every CEO Should Ask Their IT Team (or MSP) This Week

Last week, the security industry started calling October 2026 "Black October," and the name fits. Within a few days:

• •Two critical PHP flaws, nicknamed PHP2Shell, were disclosed. They let an attacker run code on a server without logging in.
• •Palo Alto Networks confirmed that every supported version of its PAN-OS firewall software and Panorama management console is affected, and most fixed releases aren't due until October 27–30. Cisco and Fortinet are still reviewing other products.
• •Attackers used the ConnectWise Cloud Backup service (formerly SkyKick), a backup tool many managed service providers (MSPs) use, to get into at least 162 Microsoft 365 tenants. Because they signed in as the application, MFA never came into play.

When something like this happens, a CEO should be able to ask one question, "Are we exposed?", and get an answer the same day. For most mid-sized companies I talk with, that answer takes weeks. And the reason usually isn't the patching. It's that nobody can say exactly what's running.

The Problem Isn't Patching Speed. It's Knowing What You Have.

• •The volume has changed. According to a CIO.com analysis, almost 80,000 vulnerabilities (CVEs) were published from January through mid-October, more than double the same period last year. AI tools are finding bugs faster than teams can triage them.
• •Exploits come first. Attackers often have working exploits before or within a day of a public disclosure.
• •Remediation is slipping. Verizon's 2026 DBIR found only about a quarter of known-exploited vulnerabilities were fully fixed.
• •The riskiest devices get the least attention. Firewalls, VPNs and other edge devices make up a growing share of exploited flaws, and they usually don't run the endpoint security tools your team monitors.

If you don't know which firewalls, servers and appliances you have, which software versions they're running and who owns them, you can't patch what matters first.

Your MSP's Tools Are Part of Your Attack Surface

The ConnectWise incident is the one I'd want every owner to understand. Most SMBs hand IT to an MSP, which is often the right call. But that MSP connects backup, monitoring and management tools to your Microsoft 365 environment, and those tools run with powerful permissions.

• •Those app connections often don't go through MFA.
• •Resetting user passwords doesn't cut them off.
• •In some affected tenants, the attacker gave itself administrator rights.

This isn't a reason to fire your MSP. It's a reason to know which third-party apps have keys to your environment, and to make sure someone is reviewing them.

Five Questions to Ask This Week

Use these with your IT lead, your MSP or both:

1. 1.Do we have one current inventory of every firewall, server, network device and cloud service, with version, location, owner and whether it's exposed to the internet?
2. 2.How long would it take to tell me whether we're affected by the next PHP2Shell: hours, or weeks?
3. 3.Which third-party applications (backup, monitoring, security, AI tools) have admin-level access to our Microsoft 365 or Google environment, and when were they last reviewed?
4. 4.Are our firewall and VPN management interfaces reachable from the internet? They shouldn't be.
5. 5.Who owns the decision to take a system offline in an emergency, and does the leadership team know who that person is?

If the answers are vague, that tells you what to fix first.

Where Companies Get This Wrong

• •They treat security as something the MSP handles completely, with no internal owner.
• •They buy another tool instead of fixing the inventory and process underneath.
• •They keep a spreadsheet inventory that hasn't been touched since the last audit.
• •They wait for a breach or a cyber insurance renewal to ask these questions.

In my years as a CTO and running large infrastructure programs, the best security investment was rarely a new product. It was clear ownership, an accurate record of what we ran, and a leader willing to ask the uncomfortable question early.

What to Do Next

• ☐Ask your IT team or MSP whether you run any Palo Alto, Cisco or Fortinet products affected by PHP2Shell, or PHP-based web apps, and confirm the patch dates.
• ☐If you use ConnectWise/SkyKick backup, confirm your MSP has reviewed your Microsoft 365 app permissions and admin role assignments.
• ☐Get a list of every third-party app with admin access to your email and files.
• ☐Confirm firewall and VPN management interfaces aren't reachable from the internet.
• ☐Name one executive owner for cyber risk and set a regular reporting cadence.
• ☐Schedule an independent cybersecurity assessment before your next insurance renewal.

Frequently Asked Questions

Related Reading