Vulnerability Management
1,413 CVEs in One Month: Why "Patch Everything" Is Dead and What Replaces It
Microsoft’s October 2026 Patch Tuesday fixed 1,413 CVEs, according to SecurityWeek . The same report says that is more than Microsoft patched in all of 2025, and that the surge is “largely driven by AI”, which is the reporter’s characterisation and not a Microsoft statement. Computerworld counts 1,408 CVEs requiring customer action, 72 of them rated critical. A small team cannot test 1,400 fixes a month. It also does not need to. The count has stopped telling you what is urgent.
Your Trust Store Is Infrastructure: What the eMudhra CA Compromise Exposed
On 17 October a researcher reported that eight eMudhra intermediate certificate authorities had private keys anyone could recover from the public certificates. Mozilla recovered the keys itself less than two hours after the report reached it, according to CSO Online . Google said the keys were generated with “insufficient randomness”. Scott Helme recovered all eight in under a second, and some of the values were as small as 4, 56 and 115. Six of the intermediates issued TLS certificates and two issued code-signing certificates.