This Week in Change Risk — Week of Oct 26, 2026
php2shell, Cisco ASA and GitLab KEV adds, three entries with months-old fixes, Cloudflare's provider outage, ServiceNow Q3 margins, PCI's Oct 31 sunsets.
The change-risk desk · Friday, October 30, 2026
RSS Standing risk monitors
All free tools →The three references this desk keeps open during a change window. Each one is free, runs in your browser, and needs no account.
- CISA KEVKnown Exploited Vulnerabilities catalog
Sortable view of the CISA KEV catalog, with the remediation deadline attached to each entry.
- MSRCNext Patch Tuesday
Rolling 12-month calendar available in the free tool.
- AWS / Azure / GCP / Cloudflare / GitHubCloud provider status heatmap
Combined status board across the five providers change teams care about.
-
php2shell KEV Deadline: Evidence First, Then the Emergency Patch
CISA's php2shell KEV entries are due Oct 29 and flagged for forensic triage. How to run the emergency change: collect evidence, patch, restart, verify.
-
October 2026 Patch Tuesday: A CAB Plan Through Year-End
Oct 13 Patch Tuesday lands on 33 Microsoft lifecycle changes, a Secure Boot CA expiry and the last Exchange ESU month. A CAB plan for Q4 and the freeze.
-
Deployment Rings: How Staged Rollouts Fit Into Change Control
How deployment rings and staged rollouts cap the blast radius of a bad change, what Apple, Google, AWS and Azure stages do, and what a CAB should require.
-
SOC 2 Type II Evidence: What Auditors Actually Sample
How a SOC 2 Type II auditor samples the observation window: sample size by control frequency, population completeness, and why exceptions happen.
-
PCI DSS 6.4.3: Payment-Page Scripts as a Change-Control Problem
PCI DSS 6.4.3 and 11.6.1 have been mandatory since March 2025. Here is how to wire payment-page script authorization into your change process.
-
The Compensating Controls Register Auditors Accept
You deferred a control and promised a compensating one. Here is the register entry that PCI, SOC 2, and NIST assessors sign off on instead of flagging.
-
This Week in Change Risk — Week of Oct 26, 2026
php2shell, Cisco ASA and GitLab KEV adds, three entries with months-old fixes, Cloudflare's provider outage, ServiceNow Q3 margins, PCI's Oct 31 sunsets.
-
eMudhra Certificate Compromise: A Trust Store Change Runbook
Browsers blocked the eMudhra intermediates on day 0. Servers, containers and runtimes may not have. A change runbook before Chrome drops the root Oct 27.
-
This Week in Change Risk — Week of Oct 19, 2026
Plex and BeyondTrust KEV adds, PHP's critical RCE fix, Google's europe-west2 power failure, the eMudhra CA compromise, and GitLab's fourth critical patch.
-
Google Cloud europe-west2 Outage: What One Zone Failure Exposed
A power event in one London zone hit 38 Google Cloud products for 7h 52m on Oct 20. What it means for zonal design, failover plans and change control.
-
Cloud Provider Incidents: A Standing Item for Your CAB Agenda
How to make upstream cloud incidents a standing CAB agenda item: triggers, owners, and what AWS, Azure, Google Cloud, and Cloudflare actually publish.
-
Azure Outage History: A Timeline of Change-Triggered Failures
A timeline of major Azure outages from 2018 to 2026, and why almost every one traces back to a change: a config push, a code deploy, or a key rotation.
-
Cloud Provider Health Feeds: AWS, Azure, Google, Cloudflare
AWS Health, Azure Service Health, Google Personalized Service Health and Cloudflare alerts compared as ITSM inputs: scope, API access, history and gaps.
-
Auth Gateways Compared: oauth2-proxy, Authelia, Pomerium
Compare oauth2-proxy, Authelia, Cloudflare Access, and Pomerium as reverse-proxy auth gateways for internal apps that lack native SSO, with a matrix.
-
Vanta vs Drata vs Secureframe: Evidence Collection Compared
How Vanta, Drata, and Secureframe handle custom controls, evidence automation, and auditor access — with a named weakness for each GRC platform.