IT Operations
1,413 CVEs in One Month: Why "Patch Everything" Is Dead and What Replaces It
Microsoft’s October 2026 Patch Tuesday fixed 1,413 CVEs, according to SecurityWeek . The same report says that is more than Microsoft patched in all of 2025, and that the surge is “largely driven by AI”, which is the reporter’s characterisation and not a Microsoft statement. Computerworld counts 1,408 CVEs requiring customer action, 72 of them rated critical. A small team cannot test 1,400 fixes a month. It also does not need to. The count has stopped telling you what is urgent.
Copilot Just Became a Utility Bill: Set the Meter Before Microsoft Does
Microsoft moved default usage-based billing for new Microsoft 365 Copilot Business subscriptions bought through the Cloud Solution Provider (CSP) channel from 2 November to 1 December 2026, according to trade coverage of the delay . Reporting attributes the move to partners needing time in sandbox environments that open on 2 November. Those sources date the announcement to the first week of October. Those extra weeks belong to IT. Copilot now has a metered side, and the people who hold the admin controls decide how that meter runs.
Your Trust Store Is Infrastructure: What the eMudhra CA Compromise Exposed
On 17 October a researcher reported that eight eMudhra intermediate certificate authorities had private keys anyone could recover from the public certificates. Mozilla recovered the keys itself less than two hours after the report reached it, according to CSO Online . Google said the keys were generated with “insufficient randomness”. Scott Helme recovered all eight in under a second, and some of the values were as small as 4, 56 and 115. Six of the intermediates issued TLS certificates and two issued code-signing certificates.