Verify Supplier Patching, SSO Controls, and Switch Sourcing Options

AI reading

CISA issued a Binding Operational Directive giving federal agencies four days to patch an actively exploited LiteSpeed cPanel user‑end plugin (CVE‑2026‑48172) that enables privilege escalation. The advisory highlights a Redis enable/disable mishandling in lsws.redisAble and urges applying vendor mitigations or discontinuing use where unavailable. Operationally, hosting and managed‑service providers running cPanel/LiteSpeed must confirm patch status and be prepared for mitigations that could affect uptime; watch supplier remediation timelines and rollback plans

Buyer takeaway

Treat supplier patch confirmation as a compliance and delivery item; require suppliers to prove remediation or provide approved mitigations before normalizing risk

Cost / money

Short‑term increase in managed‑service and on‑demand support spend is likely while suppliers push emergency patches or mitigations

Supplier / commercial

Suppliers may narrow quote validity or charge premiums for emergency maintenance; buyers can demand proof‑of‑patch clauses or temporary credits for downtime

Safety / operations

The flaw permits root code execution; operations must isolate affected systems, validate backups, and verify eradication steps to prevent persistent access

What to watch

Watch for mitigations that disable features or require reboots which could affect uptime and SLA pass‑through obligations

Key facts

• CISA Binding Operational Directive with a federal patching window
• CVE‑2026‑48172: privilege escalation via lsws.redisAble mishandling
• Vendor guidance to apply mitigations or discontinue product where mitigations are unavailable

Source excerpts

Used in this brief

• Next 72 hours — Request supplier attestations and evidence for cPanel/LiteSpeed patch or mitigation status across hosted and managed servers.. Rationale: because CISA issued a binding federal patching directive and the vulnerability is actively exploited, so supplier confirmation reduces buyer exposure and prioritizes remediation.... Owner: Category. KPI: Documented supplier attestations and a mapped inventory of patched or mitigated cPanel instances
• CISA issued a Binding Operational Directive specifically for a LiteSpeed cPanel plugin (new federal patching mandate not present in the prior brief)
• CISA issued a Binding Operational Directive giving federal agencies four days to patch an actively exploited LiteSpeed cPanel user‑end plugin (CVE‑2026‑48172) that enables privilege escalation. The advisory highlights a Redis enable/disable mishandling in lsws.redisAble and urges applying vendor mitigations or discontinuing use where unavailable. Operationally, hosting and managed‑service providers running cPanel/LiteSpeed must confirm patch status and be prepared for mitigations that could affect uptime; watch supplier remediation timelines and rollback plans

AI reading

Microsoft released the KB5089573 optional preview cumulative update for Windows 11 25H2 and 24H2 with performance and reliability improvements and a Secure Boot certificate rollout. The update is optional (non‑security preview) and Microsoft also reiterated known issues affecting domain controller lookups on some server builds, which makes staged testing important. Buyers should coordinate endpoint testing windows with desktop and identity suppliers and watch for related server lookup disruptions before broad deployment

Buyer takeaway

Treat preview updates as a coordination item between endpoint teams and identity/SaaS suppliers; require staged testing and supplier validation before enterprise rollout

Cost / money

Staged testing and remediation for known issues will consume IT operations cycles and may require supplier support time

Supplier / commercial

Endpoint and identity suppliers may need to provide compatibility guidance or remediation timelines; include update coordination clauses where possible

Safety / operations

Known issues affecting domain controller lookups can degrade admin tooling and sign‑in behavior; validate recovery steps with identity owners

What to watch

Watch for preview updates that change Secure Boot behavior and require coordinated certificate rollout to avoid unexpected failures

Key facts

• KB5089573: optional Windows 11 preview for 25H2 and 24H2 with performance/reliability fixes
• Includes Secure Boot certificate refresh guidance for impacted systems
• Microsoft noted a known issue affecting domain controller lookup failures on some server builds

Source excerpts

Used in this brief

• Microsoft released the KB5089573 optional preview cumulative update for Windows 11 25H2 and 24H2 with performance and reliability improvements and a Secure Boot certificate rollout. The update is optional (non‑security preview) and Microsoft also reiterated known issues affecting domain controller lookups on some server builds, which makes staged testing important. Buyers should coordinate endpoint testing windows with desktop and identity suppliers and watch for related server lookup disruptions before broad deployment
• Buyer bottom line: optional Windows 11 preview updates can change sign‑in and Secure Boot behavior—validate with identity and endpoint suppliers before mass rollout to avoid support incidents
• Treat preview updates as a coordination item between endpoint teams and identity/SaaS suppliers; require staged testing and supplier validation before enterprise rollout

AI reading

Cisco said it will extend SONiC (Software for Open Networking in the Cloud) support to Nexus 9000 datacenter switches, giving customers the option to run SONiC alongside ACI or NX‑OS stacks. The move broadens NOS choice for datacenter switching and targets AI‑class fabrics where NOS flexibility matters. Procurement should add SONiC compatibility checks to switch sourcing to preserve negotiation leverage and validate vendor support models before committing to a single stack

Buyer takeaway

Add SONiC compatibility to switch sourcing checklists to preserve negotiation leverage and test single‑vendor consolidation assumptions

Cost / money

Open NOS adoption may shift total cost drivers for support, training, and integration; commercial effects depend on vendor service offerings

Supplier / commercial

Vendors may offer alternative bundles or support tiers; use NOS flexibility to negotiate maintenance and support terms

Safety / operations

Introducing a new NOS requires validating interoperability, supportability, and in‑house or supplier skillsets to avoid operational downtime

What to watch

Watch for hidden integration costs or limited enterprise support when running SONiC on enterprise hardware

Key facts

• Cisco to support SONiC on Nexus 9000 datacenter switches
• SONiC option complements Cisco Cloud Scale/Silicon One or NX‑OS/ACI environments
• Positioned for customers building AI‑class fabrics seeking switching flexibility

Source excerpts

Used in this brief

• Supplier / commercial: Cisco’s SONiC support opens procurement leverage: require NOS flexibility and clarified support models in RFPs to test single‑vendor consolidation assumptions and supplier bundling
• Next quarter — Update datacenter switch sourcing templates and RFPs to include SONiC compatibility checks, interoperability tests, and clarified vendor support models.. Rationale: because Cisco’s SONiC availability on N9000 hardware creates an alternate OS path that can change supplier leverage, so adding compatibility checks preserves sourcing optionalit.... Owner: Category. KPI: RFP templates and vendor questionnaires that include SONiC support, interoperability tests, and support model clarifications
• Cisco said it will extend SONiC (Software for Open Networking in the Cloud) support to Nexus 9000 datacenter switches, giving customers the option to run SONiC alongside ACI or NX‑OS stacks. The move broadens NOS choice for datacenter switching and targets AI‑class fabrics where NOS flexibility matters. Procurement should add SONiC compatibility checks to switch sourcing to preserve negotiation leverage and validate vendor support models before committing to a single stack

AI reading

Researchers reported a critical KnowledgeDeliver LMS zero‑day exploited to deploy the Godzilla web shell by leveraging identical pre‑shared ASP.NET machine keys across deployments. The flaw allowed unauthenticated remote code execution and persistent access because attackers could sign malicious ViewState payloads with the shared machine key. Buyers should treat hosted LMS instances as potentially compromised until suppliers demonstrate key rotation, removal of web shells, and forensic evidence of eradication

Buyer takeaway

Consider hosted LMS a high‑impact supplier exposure until vendors show unique key management and demonstrable cleanup

Cost / money

Expect incremental incident response, containment, and supplier remediation costs for affected LMS instances

Supplier / commercial

Require supplier attestations of unique key deployment, key rotation evidence, and contractual obligations for forensic cleanup and monitoring

Safety / operations

Web shells enable long‑term persistence; operations must assume compromise and require proof of eradication before restoring services

What to watch

Watch for partial remediation claims or delayed key rotations that enable repeat exploitation

Key facts

• Critical zero‑day in KnowledgeDeliver exploited to deploy Godzilla web shell
• Attack leveraged identical pre‑shared ASP.NET machine keys across deployments
• Exploitation enabled unauthenticated remote code execution and persistence

Source excerpts

Used in this brief

• Cost / money: Incident response, containment, and forensic work for LMS web‑shell infections and vishing‑based SSO compromises will increase IR and recovery costs for both buyers and affected suppliers
• Safety / operations: KnowledgeDeliver instances using identical pre‑shared ASP.NET machine keys enable unauthenticated remote code execution and persistence; treat affected LMS deployments as compromised until vendors prove key rotation and web‑shell removal
• Next 72 hours — Inventory hosted LMS instances and require immediate containment confirmation from LMS suppliers, including proof of unique machine keys and web‑shell eradication steps.. Rationale: because the KnowledgeDeliver zero‑day exploited shared machine keys to install persistent web shells, so hosted LMS may already be compromised and need containment evidence.. Owner: Ops. KPI: Inventory of LMS deployments with supplier containment attestations and open remediation tickets

AI reading

Charter Communications confirmed a security incident after being listed by the ShinyHunters extortion group, which claims data stolen via a voice‑phishing attack that compromised an employee's Microsoft Entra SSO account and exported SaaS data. Charter says no sensitive personal customer information was taken and is alerting authorities, but the incident illustrates how an SSO account takeover can cascade across connected SaaS applications. Procurement should verify supplier SSO protections, token revocation procedures, and incident cooperation terms to limit cross‑SaaS exposure

Buyer takeaway

Treat supplier SSO incidents as supply‑chain events and require rapid attestation and cross‑SaaS containment procedures from impacted suppliers

Cost / money

SSO‑related breaches increase third‑party IR, notification, and recovery costs for both buyer and supplier

Supplier / commercial

Negotiate incident cooperation SLAs, evidence requirements, and token/session revocation support from SaaS and telecom suppliers

Safety / operations

Account takeover can enable lateral access to connected SaaS systems; operations must verify token revocation and audit logging from suppliers

What to watch

Watch for inconsistencies between public claims and supplier statements; require forensic evidence before closing disputes

Key facts

• Charter listed on a data leak/extortion site after alleged vishing SSO compromise
• Threat actor claimed export of customer and business records via a compromised SSO account
• Charter stated no sensitive personal customer information was exfiltrated and is notifying au

Source excerpts

Used in this brief

• Next 2-4 weeks — Issue contract change requests or SLA addenda to hosting, LMS, and SaaS suppliers requiring proof‑of‑patch, forensic cooperation, and token/session revocation support for SSO in.... Rationale: because recent SSO compromises and LMS persistence risks show supplier responsibilities materially affect buyer exposure, so contracts should mandate evidence, notifications, an.... Owner: Contracts. KPI: Amended supplier terms or documented exception workflows requiring proof‑of‑patch, timely notifications, and forensic cooperation
• Public extortion listings (ShinyHunters, Play) can trigger regulatory notification, contractual disputes, and supplier blame games; verify supplier notification timelines and breach coverage because public claims often outpace forensic confirmation
• Charter Communications confirmed a security incident after being listed by the ShinyHunters extortion group, which claims data stolen via a voice‑phishing attack that compromised an employee's Microsoft Entra SSO account and exported SaaS data. Charter says no sensitive personal customer information was taken and is alerting authorities, but the incident illustrates how an SSO account takeover can cascade across connected SaaS applications. Procurement should verify supplier SSO protections, token revocation procedures, and incident cooperation terms to limit cross‑SaaS exposure