Zammad KEV: When Your Helpdesk Becomes the Breach Path
CISA added two Zammad flaws to KEV after a breach at DIVD. What the chain exposes, why the vendor and CSIRT disagree, and how to treat your helpdesk.
The change-risk desk · Wednesday, October 7, 2026
RSS Standing risk monitors
All free tools →The three references this desk keeps open during a change window. Each one is free, runs in your browser, and needs no account.
- CISA KEVKnown Exploited Vulnerabilities catalog
Sortable view of the CISA KEV catalog, with the remediation deadline attached to each entry.
- MSRCNext Patch Tuesday
Rolling 12-month calendar available in the free tool.
- AWS / Azure / GCP / Cloudflare / GitHubCloud provider status heatmap
Combined status board across the five providers change teams care about.
-
Deployment Rings: How Staged Rollouts Fit Into Change Control
How deployment rings and staged rollouts cap the blast radius of a bad change, what Apple, Google, AWS and Azure stages do, and what a CAB should require.
-
Print Server Emergency Change: When a Utility App Turns Critical
A PaperCut NG/MF KEV entry put a 'boring' print server on a 14-day clock. Here is the emergency-change pattern for utility apps nobody tiered as critical.
-
BOD 26-04: Pre-Wire Your Emergency Change Before the Clock
CISA's BOD 26-04 sets a 16-row deadline table. Here is how a CAB pre-authorizes the ECAB so a 3-day KEV clock never catches you improvising.
-
SOC 2 Type II Evidence: What Auditors Actually Sample
How a SOC 2 Type II auditor samples the observation window: sample size by control frequency, population completeness, and why exceptions happen.
-
PCI DSS 6.4.3: Payment-Page Scripts as a Change-Control Problem
PCI DSS 6.4.3 and 11.6.1 have been mandatory since March 2025. Here is how to wire payment-page script authorization into your change process.
-
The Compensating Controls Register Auditors Accept
You deferred a control and promised a compensating one. Here is the register entry that PCI, SOC 2, and NIST assessors sign off on instead of flagging.
-
Zammad KEV: When Your Helpdesk Becomes the Breach Path
CISA added two Zammad flaws to KEV after a breach at DIVD. What the chain exposes, why the vendor and CSIRT disagree, and how to treat your helpdesk.
-
This Week in Change Risk — Week of Sep 28, 2026
This week's change-risk digest: exploited NetScaler, FortiMail and SD-WAN bugs, an Azure outage from two colliding changes, and PCI Secure SLC v2.0.
-
This Week in Change Risk — Week of Sep 21, 2026
This week's change-risk digest: 7 CISA KEV entries on 3-day clocks, including F5 BIG-IP APM, Cloudflare's APAC subsea-cable congestion, and CRA reporting.
-
Cloud Provider Incidents: A Standing Item for Your CAB Agenda
How to make upstream cloud incidents a standing CAB agenda item: triggers, owners, and what AWS, Azure, Google Cloud, and Cloudflare actually publish.
-
Azure Outage History: A Timeline of Change-Triggered Failures
A timeline of major Azure outages from 2018 to 2026, and why almost every one traces back to a change: a config push, a code deploy, or a key rotation.
-
Asset Inventory Reconciliation: The Quarterly Change
Running an external asset view against your internal inventory once a quarter turns shadow assets into a change queue. Here is the exact process.
-
Auth Gateways Compared: oauth2-proxy, Authelia, Pomerium
Compare oauth2-proxy, Authelia, Cloudflare Access, and Pomerium as reverse-proxy auth gateways for internal apps that lack native SSO, with a matrix.
-
Vanta vs Drata vs Secureframe: Evidence Collection Compared
How Vanta, Drata, and Secureframe handle custom controls, evidence automation, and auditor access — with a named weakness for each GRC platform.
-
Asset Exposure Discovery Tools Compared: 4 Approaches
Shodan, Censys, runZero, and cloud-native inventory each answer BOD 26-04's 'is it publicly exposed?' question differently. Here is how they compare.