Jason Miller, Executive Editor of the Federal News Network put out a two-part investigation last week on the CMMC pause, and we are really glad he agreed to join The CyberCall, because he got access to DoD’s own RFI results and the task force summary.

When the pause was announced in July, we were told it was about cost, burden and not having enough assessors. Jason’s reporting looks at each of those against what industry actually told DoD. The average assessment cost respondents reported was around $47,000, not the $600,000 figure we heard. Assessment capacity was never more than about half used during Phase 1. And most of the cost people complained about traces back to implementing 800-171, which hasn’t gone anywhere.

Part two gets into the options the task force laid out, including restarting Phase 2 with a smaller group, moving to Rev 3, and fixing CUI marking.

So we’ll start with what he found, then get into where this is heading and what it means for the 2,400 or so companies that already have their Level 2 certification. Jason, thanks for being here.

For years, MSPs have been working to clarify where their responsibility ends and their customers' responsibility begins. AI is complicating this distinction even further.

Your customers are deploying AI solutions, often without your knowledge. Your engineers are using AI to troubleshoot, automate, and support those same customers. And increasingly, the vendors you depend on are embedding AI into the platforms you use every day.

Here's the problem.

Just because you manage the technology doesn't necessarily mean you've agreed to manage the risk.

But does your customer understand that distinction? More importantly, does your contract reflect it?

Today we're joined by attorney Eric Tilds, whose firm represents more than 600 MSPs and Ken Ivey, CEO of TechSource.

We're going to examine the growing disconnect between AI adoption, customer expectations, and contractual responsibility. Not just what the law says, but what an MSP can realistically control, what it should be responsible for, and how to avoid discovering those boundaries for the first time during a lawsuit.

We put together a special Wednesday CyberCall after two critical PHP vulnerabilities, known as php2shell, leaked a day before their planned disclosure. John Hammond of Huntress and John Strand of Black Hills Information Security joined me to talk through what happened and what MSPs should be doing about it.

John Hammond explained why a flaw in PHP itself matters so much. It sits underneath WordPress, Drupal, Joomla, Magento, and many other platforms, and it can lead to full remote code execution on the server. He also shared why he took his own WordPress site offline until the patch was released. John Strand walked through the exposure numbers, with more than 230,000 internet-facing servers on PHP 7.x, 8.0, and 8.1 alone. He also explained how AI has shortened the time between a patch and a working exploit.

We also covered:

• Whether coordinated disclosure still works when leaks happen this easily
• Why “the website isn’t our responsibility” won’t hold up when a client gets breached
• How to explain the risk to business owners in terms they care about
• What to do with clients stuck on older PHP versions that won’t get a patch
• Why you shouldn’t run the early proof of concept code that’s circulating online

If your clients have websites, ecommerce stores, or any software that runs on PHP, this is worth a listen before the end of the week.