Eight days. Six fires.
On 14 October, Palo Alto Networks disclosed a PAN-OS flaw that gives an authenticated attacker root on the firewall through the management interface. It had already been exploited as a zero-day. On 17 October, a researcher showed that eight intermediate certificate authorities run by eMudhra had private keys anyone could recover in under a second. One of those keys was the number 4. On 19 October, Unit 42 reported ransomware crews, Qilin among them, using a GlobalProtect flaw to walk straight past MFA.
On 21 October, PHP shipped emergency fixes for PHP2Shell, unauthenticated code execution on every PHP installation serving web requests, after the details leaked a day early. The same day, Node.js shipped ten CVEs, including a remote code execution bug in its Brotli decoder. On 22 October, Palo Alto confirmed PHP2Shell sits inside every version of PAN-OS and Panorama too, with no patch and no date for one. Fixed builds are now estimated for 26 to 30 October, depending on the release train.
If you run a security function, you didn't patch your way through that week. You chose your way through it, or someone chose for you.
The scores decided nothing
Line up the numbers.
The PAN-OS root exploit, used against real firewalls: 8.6. The GlobalProtect bypass, in the hands of ransomware operators: 7.8. The eMudhra collapse, a trusted CA whose signing keys anyone could recompute, described by a Mozilla cryptography engineer as an incident with the highest possible impact: the incident itself carries no score at all, and the one downstream CVE CISA scored got a 5.4. PHP2Shell: 9.2 at PHP, and rated by Palo Alto as an availability issue on its own firewalls.
The day before all of it, Microsoft shipped more than 1,400 CVEs in a single Patch Tuesday. Sixty-nine were rated Critical. The one already being exploited was rated Important.
A CVSS score describes how bad a bug could be on paper. It knows nothing about whether anyone is using it this morning, whether it faces the internet in your estate, or what sits behind it. This week, those three things were the whole story.
Your patch policy would have scheduled the ransomware vector for next month
Open your vulnerability management policy. I'd bet it reads something like this: Critical within 7 days, High within 30, Medium within 90.
Run this week through it. PHP2Shell lands in the 7-day bucket, fine. The exploited PAN-OS root flaw is High: 30 days. The GlobalProtect bypass ransomware groups are actively using: High, 30 days. eMudhra: Medium, 90 days, assuming anyone even raised a ticket.
Your own policy would have ranked the two things attackers were actually using as second-division work, and given a compromised certificate authority a quarter to sort itself out.
As an auditor, that's what I'd write up. Being slow is one finding. A documented process that makes you slow when followed to the letter is a worse one, and that's an A.8.8 nonconformity against a policy doing exactly what it was written to do.
Decision rights are handed out in peacetime
Here's the question that separated organisations this week. Who could take a firewall management interface off the internet at 23:00, without waiting for Thursday's change advisory board?
PAN-OS gave you two reasons in eight days to stop exposing that interface. Palo Alto's guidance on the first flaw is to restrict management access to trusted internal addresses, and it says the second is most dangerous when the interface accepts connections from the internet. That's a configuration change a competent engineer makes in minutes. In most organisations, nobody is allowed to make it alone.
Amazon recorded a PHP2Shell exploitation attempt on 17 October, four days before public disclosure. CISA gave US federal agencies three days on the PAN-OS flaw. Your CAB meets weekly. The maths doesn't work, and no amount of technical talent closes a governance gap.
The emergency path has to exist before the emergency. Named people. The exact actions they can take without asking. How they log it. Who they tell afterwards. Write it on a quiet Tuesday, rehearse it once, and it'll be there on the Saturday.
eMudhra was the real test
PAN-OS and PHP have patches, or will. eMudhra has nothing to install.
The browsers moved fast. Chrome and Firefox blocked the eight intermediates on 17 October, Microsoft and Apple followed within days. eMudhra revoked them, and on 22 October announced it was leaving the TLS certificate business altogether.
Your browsers are fine. Your containers, VMs, appliances, Java keystores and every Python environment carrying its own copy of certifi are a different conversation. Node.js had to ship the distrust inside its own security release. Go shipped new versions for it.
So the question your organisation actually had to answer was this: where do we trust certificate authorities, and who can change that everywhere at once? Most can't answer the first half. That's an inventory problem, and inventory stops being an IT chore the moment a regulator asks for it. Under NIS2, the management body approves the risk-management measures and answers for them.
The order of decision
Before the score, ask four questions.
- Is it being exploited? KEV, the vendor's advisory, your threat intel. If yes, it jumps the queue whatever its number.
- Is it exposed? Internet-facing beats internal. Management interfaces beat almost everything.
- What does it touch? Identity, trust, the systems holding your data, the boxes everyone else depends on.
- What's the score? Use it to rank what's left.
Brussels landed in the same place. Since 11 September, manufacturers under the Cyber Resilience Act have had to report actively exploited vulnerabilities. Exploitation is the trigger, and the score appears nowhere in it.
Tip: Rewrite your SLA around those questions. Exploited and exposed: hours. Exploited or exposed: days. Neither: your normal cycle, with the score breaking ties. Then hand your auditor a policy you can actually follow.
What your executive committee needs to hear this week
Three sentences.
Are we exposed to any of this, yes or no. What we did, and when. What we've chosen to leave for now, and who signed off on that.
A CVE count gives them nothing they can act on. The third sentence is the one that matters. Under NIS2 Article 20, your management body approves the cybersecurity risk-management measures, oversees their implementation, and can be held liable for failures. If they never hear what was deferred, they can't own it, and you've quietly taken a decision that belonged to them.
The backlog is a decision. Sign it.
You won't fix everything. You haven't for years. The volume just makes it impossible to keep pretending.
Whatever waits has been accepted, whether anyone wrote it down or not. So write it down. A named owner, the reason, the compensating control if there is one, and a date to look at it again. A deferred vulnerability with a signature is a risk decision. Without one, it's an omission you'll be explaining later.
Final Thought
Weeks like this are going to keep coming. Discovery is accelerating faster than anyone can patch, and every scoring system will keep handing you lists where everything looks urgent.
The organisations that came through this week well had one thing in common. They knew who was allowed to decide, in what order, and how to tell the people above them what had been left on the table. Their scanners were the same as everyone else's.
That's leadership work. Nobody else in the building is going to do it for you.
Those are the skills behind three of our courses. Certified CISO by PECB for decision rights and the conversation with your executive committee. NIS 2 Directive Lead Implementer for Article 20 and what your management body now answers for. ISO 27001 Lead Implementer for a vulnerability policy you can actually follow, and risk acceptance that stands up in audit.
Pick the one that matches the gap this week exposed.