Skip to main content
Change Risk Intel
Menu
Cybersecurity

This Week in Change Risk — Week of Nov 2, 2026

Ben Ennis Founder, Ennis Studio · Editor, Change Risk Intel · 7 min read

This weekly digest is operational intelligence for change and risk owners. No affiliate links appear in this post.

Welcome to This Week in Change Risk for the week of November 2, 2026. Two themes ran through the week. The first is old risk resurfacing: a 2024 Apple flaw landed on the KEV list, and almost a third of this year’s KEV entries carry an older CVE ID. The second is the gap between installing a change and having it take effect, which both GitHub and Alpine Linux illustrated.

KEV additions this week

CISA’s KEV catalog added four entries from October 30 to November 4. Two carried short deadlines and the forensic triage flag.

  • Ivanti Connect Secure, CVE-2026-111357 (CVSS 8.8, High): missing authentication for a critical function that lets a local authenticated attacker escalate privileges. Added October 30, due November 2, triage flagged. Ivanti’s advisory says it was exploited when chained with CVE-2026-104935, and fixed versions are 25.1.1.3 and 22.8R2.6.
  • Ivanti Connect Secure, CVE-2026-118527 (CVSS 4.3, Medium): predictable filenames that let an authenticated user write files to a known location. Due November 13.
  • WordPress Core, CVE-2026-119977 (CVSS 8.1): a race condition during the upgrade window. Added November 3, due today, triage flagged. Our WordPress upgrade-window runbook covers the branch math.
  • Apple, CVE-2024-27834 (NVD 5.5, Medium): a pointer authentication bypass across iOS, iPadOS, macOS, Safari, tvOS and watchOS. Apple fixed it in Safari 17.5 on May 13, 2024. Due November 18.

The live KEV tracker has every entry.

Cloud incidents worth noting

GitHub published the root cause for its October 30 Actions, Pages and Webhooks incident, which ran from 17:50 to 18:32 UTC. It was “triggered by maintenance on a cloud network gateway” between a GitHub data center and Redis clusters in Azure Central US. The Redis client “retried aggressively,” creating a connection storm in which about 90% of connection attempts failed. GitHub’s fixes are reduced retries, jittered backoff, shorter connect timeouts and retry budgets.

The change lesson is that the maintenance was routine, and the failure came from client retry settings nobody had reviewed against it. When a CAB approves network maintenance, the question is not only what the gateway does but how every client behind it reacts to a brief loss.

The weakness this week is the follow-through. GitHub logged three more major incidents on November 4: Pull Requests, Git Operations and Issues from 09:49 to 11:50 UTC, then Actions and Pages and Actions again that afternoon. Each page still says a detailed root cause “will be shared as soon as it is available.” Our cloud status heatmap tracks providers over time.

Vendor moves

Datadog reported Q3 2026 results on November 4. Its earnings release shows revenue of $1.20 billion, up 35%, and about 4,860 customers with $100,000 or more in annual recurring revenue. It also previewed Scout 1.0, a model that powers its Bits Investigation agent for incident triage. Full-year guidance is $4.515 to $4.525 billion.

The weaknesses sit in the numbers. GAAP operating margin was 6%, against 28% on a non-GAAP basis. Q4 guidance of $1.19 to $1.20 billion is flat or down from Q3. The quarterly report says “we saw a reduction in usage from our largest customer in the third quarter of 2026, which may cause a deceleration in revenue growth.” It also says cost of revenue rose $60.7 million, mostly from third-party cloud hosting. For buyers, AI triage features are arriving faster than cost discipline, so budget for observability spend that tracks your telemetry volume, not a fixed line.

Compliance and regulatory

NIST published Cybersecurity White Paper 50, Small Business Cybersecurity: Non-Employer Firms, on November 2. It replaces NISTIR 7621, Small Business Information Security: The Fundamentals, and draws its actions from CSF 2.0. NIST says more than 28 million US small businesses are solopreneurs. For change owners, it is a useful baseline when vendor risk reviews cover very small suppliers who have no security staff.

Two deadlines matter this week. The WordPress KEV entry is due today for agencies under BOD 26-04, and many private-sector programs mirror KEV dates. Ivanti’s advisory also states that Connect Secure 22.7 and 22.8 both reach end of life on January 31, 2027, so the 25.1 migration belongs on the Q1 change calendar now. Migrating to 25.1.3.0 requires new hardware or rebuilt virtual appliances.

The PCI SSC home page also lists its Asia-Pacific Community Meeting for November 11 and 12. This is a summary of published guidance, not compliance advice.

Change-management community

Alpine Linux’s openssh-server advisory reached the Hacker News front page on November 5 with 617 points. It describes a password authentication bypass in Alpine’s default openssh-server build, which is compiled without PAM. Affected releases run from 3.16 through 3.24 plus edge, and Alpine shipped fixed packages for all of them, including branches that no longer get regular updates.

The weakness is the default configuration. PasswordAuthentication is on unless you turn it off, and no CVE ID had been assigned when the advisory went out, so scanners keyed to CVEs will not flag it yet.

The change lesson is in the advisory’s first line: “Upgrading the package alone does not replace the running daemon.” A change record that closes on a successful apk upgrade is not verified. The close-out step should confirm the running sshd version, or that a restart happened, on every host. Containers that do not run sshd are not affected.

Chart of the week

Two-panel chart. Left: 2026 KEV additions by CVE ID year, with 196 carrying 2026 IDs and 88 carrying older IDs: 38 from 2025, 10 from 2024, 8 from 2023, 11 from 2021-2022, 11 from 2015-2020 and 10 from 2008-2012. Right: KEV additions per ISO week W38 to W45 of 2026 (7, 12, 6, 5, 9, 8, 10, 2) split by forensic triage flag

The Apple entry prompted a broader pull. We grouped every 2026 entry in the catalog JSON by the year in its CVE ID. Of 284 entries added between January 1 and November 4, 88, or 31%, carry an ID from an earlier year. Most are recent: 38 are from 2025. But 21 date to 2020 or earlier, and 10 go back to 2008 through 2012.

For a CAB, an old CVE on the KEV list is rarely an emergency fix. It is a test of whether the regular patch cycle reached every asset. Systems still exposed to a 2024 Apple bug point to devices outside management, not a missing patch.

The right panel updates the weekly series. Week 44 finished at 10 after the October 30 Ivanti pair, up from the eight we reported last Friday. Week 45 has two entries through November 4.

The newsletter

If you want this digest in your inbox every Friday, subscribe to the changeriskintel newsletter and get the week’s KEV additions, cloud incidents and change-management lessons without the noise.

More weekly analysis lives on our cybersecurity pillar.

Sources

#weekly-recap #cisa-kev #cloud-incidents #change-management #vulnerability-management #patch-management

Published November 6, 2026.