When “Fully Patched” Isn’t Enough
Security researchers noted the irony: part of the surge in vulnerabilities being found and disclosed is itself being driven by AI-assisted security testing the same technology helping defenders is also accelerating how fast new weaknesses surface. Microsoft is even piloting a new "Risk Cohorts" model to help organizations triage which of the hundreds of monthly patches to prioritize first, based on exposure and deployment context.
For an SMB without a dedicated security team, a 1,400-patch month isn't just noise it's an impossible workload to manage manually.Ivanti rushed out fixes for two of the three vulnerabilities on October 13 (CVE-2026-104935 among them), and CISA added it to the KEV catalog with an October 16 deadline. A third privilege-escalation flaw remains unpatched, with a fix still pending. Researchers are advising affected organizations to go beyond patching: rotate credentials, hunt for signs of prior compromise, and confirm that management interfaces aren't exposed to the open internet.
This is the uncomfortable truth many SMBs haven't internalized yet: patch management is necessary, but it is no longer sufficient on its own. Detection, monitoring, and incident response capability matter just as much as keeping software current.
A Pile-Up of Critical Flaws Across Core Business Tools
Ivanti wasn't alone last week. CISA's KEV catalog grew by nine entries between October 13 and 16 alone, spanning tools found in businesses of every size:
- Cisco Secure Email Gateway (CVE-2026-76519) a critical, actively exploited flaw letting unauthenticated attackers run commands as root, with no workaround available.
- Atlassian Confluence/Jira Data Center (CVE-2026-21589) exploitation began within roughly two hours of a public proof-of-concept being released.
- GitLab, a maximum-severity (CVSS 10.0) flaw allowing unauthenticated code execution, alongside a separate flaw in GitLab's AI coding assistant that could cause unintended commands to run.
- BeyondTrust Remote Support, PAN-OS, and AhsayCBS backup software all added to the must-patch list the same week.
Individually, each of these might look like "someone else's problem" enterprise software a small business doesn't run. But many SMBs rely on exactly these categories of tools (remote access, email security, backup, developer platforms) either directly or through the managed service providers and software vendors they depend on. Attackers increasingly know that the fastest way into dozens of smaller businesses is through one shared vendor or platform.
It's Not Just Software — Physical and IoT Systems Are Exposed Too
In a reminder that cyber risk now extends well beyond laptops and servers, attackers last week also remotely manipulated internet-connected refrigeration controllers (from Danfoss, Dixell, and Copeland) at 250–350 French supermarkets, pushing temperatures high enough to spoil food. Investigators pointed to internet-exposed equipment and weak, easily guessed passwords as the root cause the same basic hygiene issues that compromise far more "traditional" IT systems. Separately, grocery giant Ahold Delhaize (parent of Stop & Shop and Food Lion) confirmed a cybersecurity incident that disrupted employee scheduling and payroll access in the U.S.
The lesson for SMBs: anything connected to the internet, point-of-sale systems, security cameras, HVAC controls, smart equipment, is part of your attack surface, whether or not it's managed by your IT provider today.
Why This Matters for Compliance, Not Just IT
For organizations operating under HIPAA, CMMC, FERPA, or frameworks like the NIST Cybersecurity Framework (CSF) and CIS Controls, this week is a case study in why "vulnerability management" is a named, required discipline rather than a one-time project:
- CIS Control 7 (Continuous Vulnerability Management) explicitly calls for an ongoing process to identify and remediate vulnerabilities on a defined timeline not a best-effort, whenever-we-get-to-it approach.
- NIST CSF 2.0's Identify and Protect functions require organizations to know what's on their network and maintain a disciplined patching cadence, while the Detect function (the Ivanti lesson) requires monitoring capable of catching compromises that patching alone misses.
- HIPAA's Security Rule and CMMC's practices for defense contractors both require documented risk assessments and timely remediation of known vulnerabilities something auditors increasingly expect to see evidence with real patch and detection logs, not a verbal assurance.
What SMBs Should Actually Do About It
You don't need an in-house security operations center to respond to a week like this. You need a partner and a process that treats vulnerability management as continuous, not occasional:
- Inventory what you have. You can't patch, or defend, what you don't know is running. This includes remote access tools, email gateways, backup software, and connected devices.
- Prioritize by exploitation, not just severity. A "medium" severity flaw being actively exploited right now (like several on last week's CISA KEV list) deserves faster action than a "critical" flaw with no known exploit.
- Patch fast, but don't stop there. The Ivanti case proves that attackers are increasingly targeting zero-days in security products themselves. Pair patching with monitoring and credential hygiene (rotate passwords and secrets regularly, especially after any vendor security advisory).
- Ask your vendors and MSP hard questions. Who is responsible for patching your remote access tools, backup systems, and any connected equipment? Is that documented anywhere an auditor, or a cyber insurer could review?
- Map your practices to a framework. Whether it's CIS Controls, NIST CSF, or a HIPAA/CMMC requirement that applies to your business, having a named framework turns "we try to keep up" into a defensible, auditable program.
Weeks like this one will keep happening, if anything, faster and more frequently as AI tooling accelerates both vulnerability discovery and exploitation. The businesses that weather them aren't the ones with the fewest vulnerabilities; they're the ones with a partner and a process built to find and fix them before attackers do.
If your business doesn't have a clear answer to "who is managing our vulnerability patching and monitoring right now," that's a conversation worth having before the next record-breaking patch week arrives.
