This Week in Change Risk — Week of Nov 9, 2026
11 KEV adds incl. OpenSSH and Barracuda, a GitHub migration that hit Actions, Cloudflare's Workers change outage, Jira's 422 limits and NIST SP 800-221r1.
The change-risk desk · Friday, November 13, 2026
RSS Standing risk monitors
All free tools →The three references this desk keeps open during a change window. Each one is free, runs in your browser, and needs no account.
- CISA KEVKnown Exploited Vulnerabilities catalog
Sortable view of the CISA KEV catalog, with the remediation deadline attached to each entry.
- MSRCNext Patch Tuesday
Rolling 12-month calendar available in the free tool.
- AWS / Azure / GCP / Cloudflare / GitHubCloud provider status heatmap
Combined status board across the five providers change teams care about.
-
November 2026 Patch Tuesday: A CAB Plan for 1,000+ CVEs
November 10 shipped 1,094 Microsoft CVEs, 63 Critical and one exploited Outlook flaw (KEV due Nov 24). How a CAB triages it, plus .NET end of support.
-
php2shell KEV Deadline: Evidence First, Then the Emergency Patch
CISA's php2shell KEV entries are due Oct 29 and flagged for forensic triage. How to run the emergency change: collect evidence, patch, restart, verify.
-
October 2026 Patch Tuesday: A CAB Plan Through Year-End
Oct 13 Patch Tuesday lands on 33 Microsoft lifecycle changes, a Secure Boot CA expiry and the last Exchange ESU month. A CAB plan for Q4 and the freeze.
-
Provider Incident Evidence Retention: Keep It Past 90 Days
AWS, Azure, Google, Cloudflare and GitHub drop most incident history within 30-90 days. How to keep provider evidence for SOC 2, SOX and PCI change audits.
-
SOC 2 Type II Evidence: What Auditors Actually Sample
How a SOC 2 Type II auditor samples the observation window: sample size by control frequency, population completeness, and why exceptions happen.
-
PCI DSS 6.4.3: Payment-Page Scripts as a Change-Control Problem
PCI DSS 6.4.3 and 11.6.1 have been mandatory since March 2025. Here is how to wire payment-page script authorization into your change process.
-
This Week in Change Risk — Week of Nov 9, 2026
11 KEV adds incl. OpenSSH and Barracuda, a GitHub migration that hit Actions, Cloudflare's Workers change outage, Jira's 422 limits and NIST SP 800-221r1.
-
This Week in Change Risk — Week of Nov 2, 2026
Ivanti, WordPress and a 2024 Apple flaw join KEV, GitHub's retry-storm RCA, Datadog's Q3 usage warning, NIST CSWP 50 and Alpine's sshd restart lesson.
-
WordPress CVE-2026-119977: When the Upgrade Is the Risk
CISA's WordPress KEV entry is due Nov 6 and the exposure sits in the upgrade itself. How to scope, triage and run the core update as an emergency change.
-
Google Cloud europe-west2 Incident Report: 6 Lessons for CABs
Google's report on the October 20 London outage traces it to a maintenance posture and a PLC flaw. What it means for failover, capacity and change review.
-
Google Cloud europe-west2 Outage: What One Zone Failure Exposed
How the October 20 europe-west2-b outage unfolded update by update, how zonal and regional designs behave in a zone loss, and what CABs do mid-incident.
-
Cloud Provider Incidents: A Standing Item for Your CAB Agenda
How to make upstream cloud incidents a standing CAB agenda item: triggers, owners, and what AWS, Azure, Google Cloud, and Cloudflare actually publish.
-
Cloud Provider Health Feeds: AWS, Azure, Google, Cloudflare
AWS Health, Azure Service Health, Google Personalized Service Health and Cloudflare alerts compared as ITSM inputs: scope, API access, history and gaps.
-
Auth Gateways Compared: oauth2-proxy, Authelia, Pomerium
Compare oauth2-proxy, Authelia, Cloudflare Access, and Pomerium as reverse-proxy auth gateways for internal apps that lack native SSO, with a matrix.
-
Vanta vs Drata vs Secureframe: Evidence Collection Compared
How Vanta, Drata, and Secureframe handle custom controls, evidence automation, and auditor access — with a named weakness for each GRC platform.