Skip to main content
Change Risk Intel
Cybersecurity

This Week in Change Risk — Week of Oct 12, 2026

Ben Ennis Founder, Ennis Studio · former Partner Technology Advisor, ServiceNow · 7 min read

This weekly digest is operational intelligence for change and risk owners. No affiliate links appear in this post.

Welcome to This Week in Change Risk for the week of October 12, 2026. The KEV count was ordinary, but every deadline was three days, and three of the seven entries hit appliances that sit on the network edge. Here is what mattered for change and risk owners.

KEV additions this week

CISA added seven entries to the Known Exploited Vulnerabilities catalog from October 13 to 15, each due three days later. Scores below are the vendor or CNA scores; NVD hasn’t scored most of them yet.

  • Ivanti Connect Secure, CVE-2026-104935 (8.6): authentication bypass leading to command execution. Our Ivanti analysis covers why patching alone doesn’t close it.
  • Windows Shell, CVE-2026-96951 (8.8): a security feature bypass, rated Important, exploited before the patch.
  • Palo Alto PAN-OS, CVE-2026-0322 (8.6): authenticated code execution in the management interface.
  • Cisco Secure Email Gateway, CVE-2026-76519 (9.8): arbitrary file write when File Reputation is enabled. No workarounds.
  • Ahsay AhsayCBS, CVE-2026-105134 (9.3) and CVE-2026-105133 (5.5): a backup-server chain.
  • Atlassian Data Center, CVE-2026-21589 (9.3): arbitrary file access across eight products.

Two details stand out. When Atlassian published its advisory on October 5, it said it had found no evidence of exploitation; the KEV listing ten days later means that has changed. And Ahsay’s own timeline shows partner reports from October 9. It recommends a full server rebuild where compromise indicators appear. The live KEV tracker has all seven.

Cloud incidents worth noting

Cloudflare had the noisiest week. Its status API logged 35 non-maintenance incidents between October 9 and 16, three of them rated major. Two of the three involved Ashburn (IAD). On October 13, network performance problems in IAD caused “an increase in errors across Cloudflare services,” following a separate 11-hour minor IAD incident earlier that day. On October 15, IAD and Newark (EWR) saw elevated latency and errors for about 50 minutes. A London incident the same day touched Durable Objects and R2.

The item most change owners will miss is quieter. From October 13 to 16, Audit Logs v2 ingestion was missing events from multiple Cloudflare products for about 62 hours. If your change evidence for Cloudflare configuration relies on those logs, note the gap in your records now, before an auditor asks. The weakness here is Cloudflare’s: none of the three major incidents has a published root cause yet. Our cloud status heatmap tracks provider incidents over time.

Vendor moves

ServiceNow announced AI Passport on October 15. According to the ServiceNow press release, it’s a cryptographically signed credential that AI agents and MCP servers check at runtime to confirm what data, tools and actions they’re allowed to use. Scope narrows at each delegation step, and revocation is granular. It ties into the CMDB, GRC policies and workflow approvals. For change owners, that’s the right idea. An agent should prove it’s authorized for a change before making it, not just leave a log afterwards. The weaknesses: AI Passport is only “expected to be available in Q4 2026,” with no firm date. And the production enforcement layer announced runs on NVIDIA’s agent safety platform, which is another dependency to evaluate.

PagerDuty is retiring a feature that change reviews depend on. Its release notes say Postmortems reach end of life on October 31, 2026 for all customers, replaced by Post-Incident Reviews. The weakness is the forced migration two weeks out. If your change-failure reviews live in PagerDuty Postmortems, export them before the deadline.

Compliance and regulatory

Two PCI Security Standards Council sunsets end in two weeks. Per the PCI SSC standards page, the sunset periods for the Software-based PIN Entry on COTS (SPoC) standard and the PCI 3-D Secure SDK standard both run from May 1 to October 31, 2026. The Council points to Mobile Payments on COTS (MPoC) as the standard that builds on SPoC. It doesn’t explicitly call MPoC a replacement, and it doesn’t spell out what happens to existing validations after October 31. If you run a mobile PIN-entry or 3DS SDK solution, confirm its validation status with your vendor and acquirer now.

In the EU, October 17 marks two years since the NIS2 transposition deadline. The Commission referred Ireland, Spain, France and the Netherlands to the Court of Justice in July, seeking financial sanctions for failing to transpose the directive. If you operate across EU states, your obligations still depend on each country’s national law. This is a summary of published guidance, not compliance advice for your environment.

Change-management community

The thread that best fit change control this week was on Hacker News (606 points, 292 comments), about a GitHub issue reporting that Codex CLI starts a persistent, self-updating background daemon by default. The reporter says that since version 0.157.0, an interactive session can launch a daemon that stays running after the window closes. It copies about 374 MB of binaries into the user’s home directory and checks for updates five minutes after startup and then hourly. It can also restart the backend mid-session. The issue asks for auto-start to be opt-in and is still open.

The discussion split along a familiar line. Some argued fast-moving tools need to update quickly. Others said self-managed updaters go around the package managers and internal npm mirrors that enterprises rely on to keep software inside their compliance processes. For change owners, the lesson is broader than one tool. Any developer tool that updates itself makes production-adjacent changes on its own schedule. Inventory those tools, and decide whether their updates go through your process or are formally excluded from it.

Chart of the week

Bar chart of CISA KEV additions per ISO week from week 35 to week 42 of 2026: 11, 10, 14, 7, 12, 6, 5 and a partial 7, against an 8-week average of 9.0, with a side panel showing week 42 entries by vendor or CNA score: 3 critical, 3 high, 1 medium

This chart counts KEV additions per ISO week from the dateAdded field in CISA’s catalog JSON, version 2026.10.15. Week 42 shows seven entries through Thursday, a little under the eight-week average of 9.0. Week 41 settled at five, with no weekend additions after last Friday’s count. The total isn’t the story. All seven W42 entries got a three-day due date, and three of them (Ivanti, PAN-OS and Cisco) are network-edge or email appliances, often the hardest systems to change quickly. That brings 2026’s total to 262 KEV additions.

Microsoft’s October release note lists 1,453 CVEs, and third-party tallies range from about 1,407 to 1,413 depending on what they count. Only one Microsoft CVE reached KEV this week. A patch program that ranks by volume would have buried it. Ranking by exploitation, as Monday’s Q4 Patch Tuesday plan recommends, puts it first.

The newsletter

If you want this digest in your inbox every Friday, subscribe to the changeriskintel newsletter and get the week’s KEV additions, cloud incidents and change-management lessons without the noise.

More weekly analysis lives on our cybersecurity pillar.

Sources

#weekly-recap #cisa-kev #cloud-incidents #change-management #vulnerability-management #patch-tuesday

Published October 16, 2026.