Skip to main content
Change Risk Intel
Cybersecurity

This Week in Change Risk — Week of Oct 5, 2026

Ben Ennis Founder, Ennis Studio · former Partner Technology Advisor, ServiceNow · 7 min read

This weekly digest is operational intelligence for change and risk owners. No affiliate links appear in this post.

Welcome to This Week in Change Risk for the week of October 5, 2026. The KEV count was low, but the entries were unusual: most of them are older than many of the systems they run on. The cloud story is less about one big outage than about a developer platform having a rough week. Here is what mattered for change and risk owners.

KEV additions this week

On October 8, CISA added five entries to the Known Exploited Vulnerabilities catalog, all due October 11, a Sunday. None is new. CVE-2015-3306 is a ProFTPD mod_copy flaw (CVSS 10.0) that lets remote attackers read and write arbitrary files. CVE-2021-3199 is a path traversal in ONLYOFFICE Document Server (CVSS 9.8). CVE-2016-3081 affects Apache Struts when Dynamic Method Invocation is enabled (8.1). CVE-2015-5477 is a BIND denial of service (7.5). CVE-2023-22894 is a Strapi admin-panel data exposure. Old CVEs on KEV usually mean old software still running somewhere, so check forgotten FTP servers and legacy Struts apps first.

Two weekend entries landed after last week’s recap. The two Zammad helpdesk flaws are covered in our Zammad analysis. Citrix’s CTX697174 bulletin describes CVE-2026-88779 as a memory overflow leading to denial of service (CVSS 4.0 8.7). Only appliances set up as a SAML service provider or identity provider are affected. Our live KEV tracker has all eight.

Cloud incidents worth noting

GitHub had the week every release manager felt. Its status page logged four critical incidents and one major one between October 5 and 7, touching Actions, Git operations, pull requests and webhooks. The October 5 incident has a written cause. From 18:48 to 22:49 UTC, a partial networking failure cut connectivity between one of GitHub’s on-premises datacenter regions and some cloud-hosted database and storage services. At the worst point, 47.0% of workflow runs on GitHub-hosted runners failed. Self-hosted runners were not affected. The weakness is that the October 6 and 7 incidents still say a root cause analysis “will be shared.” If your deploys run through hosted Actions, you have no fallback during an outage like this. Self-hosted runners for release-critical pipelines are one option.

Google Cloud had a quieter but longer event. Per its incident report, Cloud Storage in us-central1 saw elevated latency and errors on uploads and writes from 05:19 to 16:30 Pacific on October 8, with “None at this time” listed as the workaround. No cause is stated yet. Our CAB agenda guide covers how to log both.

Vendor moves

ServiceNow launched AI Workflow Factory on October 6. Per the ServiceNow press release, it chains Process Mining, an Autonomous Engineer and Build Agent, and App Engine into one loop. The loop finds processes to change, builds the improvement, and lets AI agents roll it out across business units “in tandem,” under AI Control Tower guardrails. ServiceNow says “people still set the direction and approve the outcome.” The weakness for change owners is in the example itself. A workflow that agents deploy to several business units at once is a production change with a wide blast radius. It needs a ring plan and a halt owner, not just an approval at the end. Also note that the Autonomous Engineer is early access only.

Zammad shipped version 7.2.1 on October 6 with 27 security fixes, including a critical MFA bypass. Zammad says SaaS instances were already patched. The weakness is Zammad’s policy of fixing only the current stable release, which leaves pinned self-hosted installs with a major upgrade as their only patch path.

Compliance and regulatory

FedRAMP published its fiscal-year review on October 8. Per the FedRAMP blog, the program issued 92 new certifications in FY26 (66 Rev5 and 26 under the newer 20x framework), and it ended the year with 538 certified cloud offerings. It also recorded 760 new agency authorizations to operate or use. The date to note is June 11, 2027, when FedRAMP will stop processing legacy Rev5 certification applications. FedRAMP says providers without significant Rev5 progress and a guaranteed sponsor “should pivot to FedRAMP 20x immediately,” and it expects transition paths for all services by the end of FY27. Under the 20x model, the old Significant Change Request process now has an optional Significant Change Notification path, so a provider’s change process becomes part of its assurance story. The program did all this while running at more than a 50% staff reduction from two years ago, with 17 federal employees and 15 contractors. If you buy from FedRAMP vendors, ask where each one sits on the Rev5-to-20x path. This is a summary of published program guidance, not compliance advice for your environment.

Change-management community

The most useful operations thread on Hacker News this week (645 points, 312 comments) was Simon Willison’s argument that usage-billed services need default hard budget caps. His point is that soft caps that only send warnings “will not cut it” now that coding agents make it easy to create services that rack up paid API, hosting and compute charges. He proposes hard caps on by default, with opting out requiring an explicit checkbox accepting the charges. He notes Google Cloud already offers spend caps on specific services, while AWS’s monthly spend limits have reached only a limited set of customers. The counterargument he addresses is that a business may not want its app to start returning errors when it hits a budget. His answer is that most would prefer errors to “a surprise $10,000+ bill.” For change owners, a budget cap is a guardrail on an automated change you didn’t review. If agents can provision resources in your accounts, the spend limit belongs in the change record too, alongside the approval.

Chart of the week

Bar chart of CISA KEV additions per ISO week from week 34 to week 41 of 2026: 9, 11, 10, 14, 7, 12, 6 and a partial 5, against a week 34 to 40 average of 9.9

This chart counts KEV additions per ISO week from the dateAdded field in CISA’s catalog JSON, version 2026.10.08. Week 41 shows five entries through Thursday, about half the seven-week average of 9.9. Week 40 settled at six after three entries arrived from October 2 to 4. That’s the third week in a row that weekend additions came in after our Friday count. The age of this week’s entries is the bigger story. All five are CVEs from 2015 to 2023. Across all 255 KEV additions so far in 2026, 40, about 16%, carry a CVE year of 2023 or earlier. A KEV program that only watches new advisories will miss them. Your asset inventory needs to answer “where are we still running ProFTPD 1.3.5?” as quickly as it answers questions about this month’s patches.

The newsletter

If you want this digest in your inbox every Friday, subscribe to the changeriskintel newsletter and get the week’s KEV additions, cloud incidents, and change-management lessons without the noise.

More weekly analysis lives on our cybersecurity pillar.

Sources

#weekly-recap #cisa-kev #cloud-incidents #change-management #vulnerability-management

Published October 9, 2026.