Security Isn't a Luxury Anymore: Inside a Month of Critical CVEs

October 29, 2026

October 2026 made something plain: vulnerability disclosures now arrive faster than most organizations can read them, and exploits follow within hours. Microsoft’s October Patch Tuesday alone fixed more than 1,400 vulnerabilities. A week later, two critical flaws in PHP leaked before their fix was even published.

This is the new reality, and that’s just the facts. For a company whose software runs water systems, oilfield operations and other critical infrastructure, cybersecurity is not a luxury or a line item. It is what keeps us, and our customers, functioning.

Here is what last month looked like from inside SitePro, and what we think every operator should expect from the vendors they trust.

PHP2Shell: from headline to resolved in a day

On October 20, details of two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619, leaked ahead of coordinated disclosure. Nicknamed PHP2Shell, each scored 9.2 out of 10. A single unauthenticated web request could let an attacker run code on a server, and working exploits were public within a day. PHP shipped fixed versions on October 21.

Researchers at Wiz noted the underlying bugs had existed for decades. What changed is that frontier AI models made them practical to exploit. That is the shift every defender is now living with.

Our security team raised PHP2Shell internally shortly before 1 PM on October 21. Here is how the day went:

Scope first. Within the hour, we had it scoped. The platform our customers rely on doesn’t run PHP, and the exposure was limited to a small number of systems outside it.
Ticket in 30 minutes. The issue was logged as a tracked vulnerability within half an hour, with the CVEs, owners and a change hold noted before anyone touched production.
Confirm who owns the fix. One affected system runs on managed hosting, so we escalated to the provider the same afternoon and tracked their fix to completion.
Remove, don’t just patch. The development servers didn’t need PHP at all. By 5:33 PM it was switched off and verified, eliminating the exposure instead of waiting on an update.
Keep going. The next morning, the team moved straight on to the Node.js security release that dropped the same day, and used the momentum to shrink our external footprint further

It wasn’t just PHP

PHP2Shell got the headlines, but it landed in one of the busiest months for vulnerabilities we have seen. Our team triaged each of these against what we actually run.

Date	Advisory	Severity	What it meant for us
Oct 13	Microsoft Patch Tuesday: 1,400+ fixes, including three zero-days	77 critical	Fed our monthly endpoint review, which now runs on a fixed schedule with every exception tracked to closure.
Oct 13–15	Schneider Electric SAGE RTU advisory	ICS / OT	Confirmed it does not affect the industrial PCs we ship.
Mid-Oct	Linux kernel and Windows QUIC flaws	High	Checked against our edge devices and servers at our weekly compliance review.
Oct 20–21	PHP2Shell (CVE-2026-109618, -109619)	Critical, 9.2	Remediated the same day; PHP removed where it wasn’t needed.
Oct 21	Node.js security releases: 10 fixes, 4 high, including a Brotli remote code execution bug some dubbed “Node2Shell”	High	Ticketed the next morning, with fixes for every affected service merged the same day.

The volume is the story. Each item had to be read, matched against our own systems, and either closed out or assigned. Doing that well, week after week, is what separates a security program from a security policy.

What made the response fast

None of this was heroics. It came from habits the team had already built:

A standing threat-intel review. Our compliance committee meets weekly and walks through new advisories before they become emergencies.
Know what you run. Fast scoping depends on an accurate inventory. The first hour of any incident is wasted if nobody knows where a technology lives.
Everything gets a ticket. Every vulnerability, change and exception is tracked with an owner and a date. If it isn’t written down, it didn’t happen.
Verify vendors, don’t trust them. Third parties are part of your attack surface. We get patch confirmations in writing and follow them to completion.
Shrink the target. The safest service is the one that isn’t exposed. Turning off what we don’t need beats racing to patch it.

Why this matters for critical infrastructure

When a retail website gets breached, customer data is at risk. When infrastructure software is compromised, the consequences reach pumps, tanks, treatment plants and the communities that depend on them. Utilities and operators can’t afford vendors who find out about a critical flaw from the news a week later.

This month also fell inside our SOC 2 attestation period. We didn’t pick the timing, but we welcomed it. An audit asks whether security controls actually operate, not just whether a policy says they will. A real-world, high-pressure week like this one is the clearest evidence we could give.

We are not finished. Like every growing company, we keep formalizing policies and closing gaps as the threat landscape shifts. But the core muscle, seeing a threat, scoping it, and acting on it within hours, is in place and working.