Skip to main content
Change Risk Intel
Cybersecurity

This Week in Change Risk — Week of Oct 19, 2026

Ben Ennis Founder, Ennis Studio · Editor, Change Risk Intel · 7 min read

This weekly digest is operational intelligence for change and risk owners. No affiliate links appear in this post.

Welcome to This Week in Change Risk for the week of October 19, 2026. Several of this week’s biggest items weren’t in KEV at all. A web runtime, a certificate authority and a cloud zone all forced unplanned changes. Here is what mattered for change and risk owners.

KEV additions this week

CISA’s KEV catalog added two entries on October 16, after last week’s count, and six on October 20.

  • BeyondTrust Remote Support, CVE-2026-102764 (CVSS 4.0: 9.3): affects versions 26.2.3 and earlier. SaaS was patched October 9. Self-hosted appliances older than 24.3.1 must upgrade before they can take the patch.
  • Fortinet, CVE-2025-61624: a path traversal across FortiOS, FortiProxy, FortiPAM and FortiSwitchManager. FortiOS 7.2, 7.0 and 6.4 have no fix and must migrate.
  • Plex Media Server, four CVEs (CVE-2026-96652, 96654, 96655 and 96656). Plex says they’re “actively and widely exploited” since a public proof of concept on October 16, and that internet-reachable servers older than 1.43.3.10861 should be assumed compromised.
  • SiteGuard Server Edition, CVE-2026-106931 (OS command injection) and Siemens Software Center, CVE-2026-110936 (CVSS 3.1: 6.7, fixed in V4.0.9.8).

Not in KEV yet, but treat it as if it were: PHP fixed two unauthenticated RCE flaws (CVE-2026-109618 and CVE-2026-109619) in 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Our live KEV tracker lists every entry.

Cloud incidents worth noting

The incident of the week was Google Cloud’s. Google’s preliminary incident report says a grid disruption hit the facility hosting europe-west2-b, and “both primary and backup PLCs” failed to start the diesel generators. The zone went offline when the UPS batteries ran out. Customers in the other two zones were hit too. Google cites “instantaneous demand surges on unimpacted compute capacity” and “synchronous control-plane validation dependencies across zonal boundaries.” New VM creation didn’t resume until 04:46 Pacific. The weakness: a zone outage spread across the region through control planes that waited on validations from the offline zone. Our europe-west2 analysis covers what that means for zonal design.

Cloudflare logged 21 incidents from October 16 to 22. One was critical: on October 20, Gateway traffic matched by identity-based policies failed for just over three hours. Separately, audit log delivery for WARP and Zero Trust was delayed on October 22, and some logs “may be delayed or not delivered,” which matters if they’re part of your change evidence. Our cloud status heatmap tracks providers over time.

Vendor moves

GitLab shipped its fourth critical patch release in six weeks on October 21. The headline fix, CVE-2026-110264, is a CVSS 10.0 flaw in the regular expression compiler that could let an unauthenticated user run code on the server. It affects every version back to 7.0. GitLab.com and current Dedicated tenants are already patched. The weakness is cadence: earlier critical releases landed on September 10, September 23 and October 12. Self-managed teams that route each one through normal change approval are permanently behind. A pre-approved standard change for GitLab critical patches is overdue for most CABs.

Atlassian added twelve Jira Service Management tools to its Rovo MCP server on October 20. They include decideJsmRequestApproval, which can “approve or decline a pending approval,” and approveJsmRequestResolverPlans. The weakness for change control is that an AI agent can now act on approvals. Check whether your change approvals sit in JSM request types an agent could reach, and whether your audit trail records which approvals came from MCP.

Compliance and regulatory

Italy’s NIS2 regime reaches a practical milestone this month. Italy’s national cybersecurity agency, ACN, met the European Commission on October 14 and 15 to review NIS2 implementation. According to ACN’s summary, the meeting arranged a further update to the list of NIS entities and planned refinements for the 2027 registration. It also presented first results from sector working groups on strengthened security measures under Articles 23, 24 and 31 of the Italian NIS decree. ACN said about 10% of NIS entities would be contacted in the coming weeks to refine their impact analyses. The ACN page doesn’t restate deadlines. If you have Italian entities in scope, confirm your baseline-measures date with counsel, because it depends on when you were added to the list.

The PCI SSC sunsets we flagged last week, for SPoC and the 3-D Secure SDK, still end October 31. This is a summary of published guidance, not compliance advice for your environment.

Change-management community

The eMudhra certificate story topped Hacker News on October 20 and again on October 22, when eMudhra said it would exit the public TLS business. Mozilla says it learned on October 17 that the private keys of eight eMudhra intermediates were compromised. Mozilla blocked them through OneCRL within three hours and is removing the signing root from NSS. Google blocked the intermediates the same day and is removing emSign ECC Root CA - G3 from the Chrome Root Store on October 27. Google found no certificates from the affected intermediates in CT logs. eMudhra says the weak keys came from a 2025 key-ceremony flaw that went unnoticed for about 18 months.

The change lesson is in the root removal, not the compromise. Any service still chained to that root becomes untrusted next week. And appliances, runtimes and containers with their own CA bundles won’t get browser fixes. That’s an emergency change with a known date.

Chart of the week

Bar chart of CISA KEV additions per ISO week from week 36 to week 43 of 2026: 10, 14, 7, 12, 6, 5, 9 and a partial 6, against an 8-week average of 8.6, with a side panel showing that five of the eight entries added October 16 to 21 had three-day deadlines and three had 14-day deadlines

This chart counts KEV additions per ISO week from the dateAdded field in CISA’s catalog JSON, version 2026.10.21. Week 42 settled at nine after the October 16 BeyondTrust and Fortinet entries, up from the seven we counted last Friday. Week 43 has six, all added on Monday, October 20, below the eight-week average of 8.6. That brings 2026 to 270 KEV additions.

The side panel uses the dueDate field. Of the eight entries added October 16 to 21, five got three-day deadlines and three got 14 days. Even Plex was split: two of its four CVEs were due in three days, two in fourteen. If your patching process treats one vendor advisory as one change with one deadline, it would have missed the earlier two. Our BOD 26-04 decision matrix shows how to route each tier.

The newsletter

If you want this digest in your inbox every Friday, subscribe to the changeriskintel newsletter and get the week’s KEV additions, cloud incidents and change-management lessons without the noise.

More weekly analysis lives on our cybersecurity pillar.

Sources

#weekly-recap #cisa-kev #cloud-incidents #change-management #vulnerability-management #certificates

Published October 23, 2026.