Skip to main content
Change Risk Intel
Cybersecurity

This Week in Change Risk — Week of Oct 26, 2026

Ben Ennis Founder, Ennis Studio · Editor, Change Risk Intel · 7 min read

This weekly digest is operational intelligence for change and risk owners. No affiliate links appear in this post.

Welcome to This Week in Change Risk for the week of October 26, 2026. This week’s KEV list held two kinds of risk. Some entries are brand new and need an emergency change. Others were patched months ago and only now confirmed as exploited. Each kind tests a different part of your change process.

KEV additions this week

CISA’s KEV catalog added eight entries from October 26 to 29. Five carry three-day deadlines.

  • PHP, CVE-2026-109618 and CVE-2026-109619 (CVSS 4.0: 9.2): added October 26, due October 29, flagged for forensic triage. Our php2shell runbook covers the evidence-first sequence.
  • Linux kernel, CVE-2026-46300 (“Fragnesia,” CVSS 7.8): a local privilege escalation through ESP-in-TCP. Red Hat’s bulletin warns that its module-blocking mitigation breaks IPsec. Due October 31.
  • Cisco ASA and FTD, CVE-2026-76418 (CVSS 8.6): an unauthenticated device reload via SSL VPN when secondary authentication is configured. Cisco confirms active exploitation, and there’s no workaround. Due November 1.
  • GitLab, CVE-2026-97229: a regex integer overflow, due November 1. Ruby’s advisory says any Ruby app compiling attacker-controlled patterns needs 4.0.9, 3.4.12 or 3.3.13.
  • Adobe Commerce CVE-2026-48356 (CVSS 9.6), Google Brotli CVE-2026-111497 and VMware ESX CVE-2026-41709 (CVSS 2.7, logging gap) are due November 10-11.

The live KEV tracker has every entry.

Cloud incidents worth noting

Cloudflare’s status history shows 29 incidents from October 23 to 29, two of them major.

On October 23, an outage at a connectivity provider degraded traffic between Ashburn and Atlanta. It ran from 15:47 to 18:43 UTC, and Cloudflare said “the infrastructure provider later experienced a recurrence of the failure.” Workers and other services saw latency and packet loss.

On October 27, customers whose traffic passed through an external vendor’s firewall saw ERR_TIMED_OUT and ERR_EMPTY_RESPONSE errors for almost three hours. The weakness in both incidents is the same: the cause sat with a third party Cloudflare depends on, and neither incident page published a root cause. If Cloudflare is in front of your production traffic, a provider failure upstream of Cloudflare belongs in your dependency map.

Google Cloud’s incident history lists no new incidents for the week. The final report for the October 19 europe-west2 outage still hasn’t been posted, and that report is where the preventive actions will appear. Our cloud status heatmap tracks providers over time.

Vendor moves

ServiceNow reported Q3 2026 results on October 28. Its earnings release shows subscription revenue of $3.99 billion, up 21%, and cRPO up 20.5%. The company raised its full-year subscription and free cash flow outlook. The weakness is cost. GAAP subscription gross margin fell to 73.5% from 80% a year earlier, and GAAP operating margin fell to 9.5% from 17%. Q4 guidance also has cRPO growth slowing to 18.5%. For buyers heading into renewal, margin pressure on the vendor side is worth knowing before you negotiate AI add-ons.

GitLab’s Orbit product page now says Orbit “is generally available.” GitLab’s launch post describes it as a queryable graph of code, merge requests, pipelines, deployments and vulnerabilities, which agents can reach through MCP. That could speed up blast-radius analysis for change reviews. The weakness is this week’s KEV list: CVE-2026-97229 was fixed in 19.4.2 on October 12 and is now confirmed exploited. Self-managed teams still on a monthly patch cycle were exposed for weeks.

Compliance and regulatory

The SEC published its fiscal year 2027 examination priorities on October 23. The list includes “operational resiliency, cybersecurity, and protection of customer information,” as well as emerging technologies “that may affect market operations, compliance, fraud prevention, and investor protection.” For registered firms, change records and incident evidence are exactly what examiners ask for under operational resilience.

PCI SSC’s sunsets for SPoC and the 3-D Secure SDK take effect tomorrow, October 31, as listed on its standards page. The council also published a new Key Management and Operations (KMO) Standard v1.0 for entities that use cryptographic keys, but its home page lists no effective date.

Separately, PagerDuty retires its Postmortems feature on October 31. If your post-incident reviews live there, export them today, because auditors may ask for them later. This is a summary of published guidance, not compliance advice.

Change-management community

Tailscale’s SSH investigation and remediation update reached the Hacker News front page on October 27 with 390 points. Tailscale published four bulletins, TS-2026-014 through TS-2026-017. It says “most of the Tailscale SSH issues we’ve identified concern privilege escalation,” where a user already allowed to connect “may be able to perform actions beyond the permissions of their configured local user.”

The weakness is timing. The update said a patched client was targeted “by the end of Tuesday 27 October, subject to successful testing,” but gave no version number. That leaves change teams unsure what to roll out.

The change lesson is about access grants, not the bug. Tailscale SSH policies decide who can reach a machine and as which local user. Any review that checks network reachability but not the local user mapping would miss this class of issue. Until the client update is deployed and verified, treat each SSH grant like a privileged account.

Chart of the week

Two-panel chart. Left: days from vendor fix or advisory to KEV listing for the eight entries added October 26 to 29, from 1 day for Cisco ASA to 174 days for the Linux kernel Fragnesia flaw, with VMware ESX at 91 and Adobe Commerce at 105. Right: KEV additions per ISO week W37 to W44 of 2026 (14, 7, 12, 6, 5, 9, 8, 8) split by forensic triage flag

For each of this week’s KEV entries, we compared the CISA dateAdded against the date of the vendor’s advisory or fix. Four entries were listed within a week of their fix: Cisco at 1 day, both PHP flaws at 5 days, and Brotli at 6. GitLab came 17 days after its fix. Three had been fixed for three months or more: VMware ESX at 91 days, Adobe Commerce at 105 and the Fragnesia kernel flaw at 174.

That split matters for CABs. Fresh entries need an emergency change. Old entries test whether your normal patch cycle actually ran. A three-day deadline on a July patch usually means a missed regular cycle, not new risk.

The right panel uses the catalog JSON. Week 43 finished at eight after two October 23 additions, Arista VeloCloud Orchestrator and Collabora Online. That brings 2026 to 280 KEV entries. Half of this week’s entries carry the forensic triage flag.

The newsletter

If you want this digest in your inbox every Friday, subscribe to the changeriskintel newsletter and get the week’s KEV additions, cloud incidents and change-management lessons without the noise.

More weekly analysis lives on our cybersecurity pillar.

Sources

#weekly-recap #cisa-kev #cloud-incidents #change-management #vulnerability-management #patch-management

Published October 30, 2026.