The 24-Hour Trust Test: What Black October Reveals About Proactive Vulnerability Response

Three major vulnerabilities were disclosed in a 48-hour window this week, leading the cybersecurity community to label this month “Black October.” On October 20, The Register revealed that certification authority eMudhra’s private keys were compromised. The next day, PHP shipped emergency patches for two critical vulnerabilities now referred to as PHP2Shell. Later the same day, Node.js shipped an emergency patch for a bug called Node2Shell.

Within hours of each announcement, companies around the world started sending—and receiving—inquiries on just who had been affected and how. Drata’s Trust Graph from this period reveals a massive increase in proactive communication: 

• This week, we saw an 8x increase in the number of vulnerability and incident updates published in Drata Trust Centers.
• In the wake of news breaking about PHP2Shell, Node2Shell, and eMudhra, 36% of our enterprise customers published an update to their Trust Center, a majority of them within 24 hours of patches being announced.
• Additionally, we saw a 13x increase in the number of emails our customers sent to their Trust Center subscribers.
• We saw a 100% increase, week over week, in the number of companies who subscribed to get their vendors’ Trust Center updates.

These figures point to a practical lesson: vulnerability response has a communications workload alongside the technical response. With this much demand for information, your security team’s response determines whether you keep the trust of your customers and prospects. Customers and prospects want a clear answer while your team is still investigating, patching and validating exposure. It doesn’t matter if you have a fix underway and ready to ship; if you don’t have an immediate answer, they’ll make up their own minds about your security posture.

What Happened: PHP2Shell, Node2Shell and eMudhra

PHP2Shell consists of two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619. Both score 9.2 on CVSS v4.0, and an attacker needs no authentication to use either one. Maintainers patched them in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. 

Node2Shell (CVE-2026-111497) is an out-of-bounds write in the Brotli decoder that ships with Node.js. Feed it malformed compressed data and it can lead to remote code execution. Node.js rates it High; the CVE record scores it 9.8 on CVSS 3.1 and 9.2 on 4.0. 

The eMudhra incident followed a different path. Eight intermediate CA certificates turned out to have weak keys, reportedly recoverable in under a second. One of them was simply the number 4. Whoever held those keys could issue fraudulent HTTPS certificates for sites they don't control. On October 22, eMudhra announced it was withdrawing from the TLS certificate business altogether.

What the Drata Trust Graph Shows about Proactive Response

The Drata Trust Graph turns activity across our customers’ Trust Centers into measurable patterns. During the week of Oct. 19, those patterns show two behaviors moving together: buyers were actively looking for updates, and vendors were publishing them quickly.

• Vulnerability and incident updates published in Drata Trust Centers ran 8x above a typical week.
• After PHP2Shell, Node2Shell and the eMudhra incident made headlines, 36% of enterprise customers published a Trust Center update about the events. Most published within 24 hours of the relevant patches being announced.
• Customers sent 33,359 emails to Trust Center subscribers from Oct. 19-23, compared with 2,506 the week before—a 13.3x increase.
• Subscriptions to Trust Center updates nearly doubled week over week, indicating that buyers were actively seeking updates from their vendors.

Update volume across Drata Trust Centers was flat on Monday and Tuesday, then jumped on Wednesday, when PHP shipped its patches. PHP2Shell accounted for most of the increase. eMudhra updates began going out on Tuesday in smaller numbers.

Across the week, vulnerability and incident updates published in Drata Trust Centers ran 8x above a typical week.

During Oct. 19-23, Trust Center subscribers received 33,359 emails, up from 2,506 the week before. That was also more than four times the previous high in this window: 7,587 emails during the week of Sep. 28, when the Citrix vulnerabilities hit. 

Subscriptions held steady for four weeks, then increased sharply during the week of Oct. 21. The pattern suggests that buyers were seeking updates proactively rather than waiting for a vendor to email them.

The data points to a shared need: an answer from the source, in one place, fast.

When vendors publish and buyers subscribe, customers and prospects can find the answer without sending one-off “are you affected?” emails—and security teams avoid answering the same question repeatedly.

Vulnerability Response is a Communications Test 

With vulnerabilities of this scale, your customers want to know sooner rather than later: are you impacted, not impacted, or still investigating? If you haven’t proactively published an update via your Trust Center or sent them an email, every customer and late-stage prospect will reach out individually. 

Each request adds another conversation to a workload that already includes asset inventory, impact analysis, remediation and evidence collection.. In weeks like this one, your team could manually respond to every request around the clock and still not keep up with the demand for answers—forcing them to neglect the critical security work where they should be focused.

Publishing one accurate answer in a central location gives customers a reliable source while your team continues the investigation.

The Anatomy of a Good Response

A good response is accurate and ready to go before you’re asked for it. 

1. Hour 0 to 24: Announce. Publish a Trust Center update and notify the audience that needs it. Drata’s Trust Center Updates go to opted-in subscribers via email when you publish, and you can import a CSV to reach a custom audience (confirming that you have permission to email them). Tell them whether you’re affected, not affected, or investigating, and skip false certainty. 
2. Day 1 to 3: Route the right evidence. Remediation evidence belongs with the reviewers who need it,. Keep sensitive technical details out of a public update. If you’re a Drata customer, use Permission Profiles to control who sees what. Meanwhile, buyers will have questions your update didn't cover. Trust Center’s Ask AI answers them in natural language, drawing on your uploaded content, so nobody files a ticket.
3. Day 1 to 7: Prepare for the questionnaire wave. Customers will still send "are you affected by [this week's vulnerability]?" in an ad hoc questionnaire. Add your answer to your knowledge base so AIQA answers accurately and consistently.
4. Ongoing: Keep the answer current. Situations move. PHP disclosed another finding on Oct 23, and Chrome's eMudhra removal isn't complete until Oct 27. Post a follow-up update when your status changes, and update the approved answer behind your questionnaire responses at the same time. 
5. After: Learn. Review who accessed the update and what questions followed.Trust Center analytics show access requests, views, downloads, subscriptions, and questionnaire volume, which tells you where buyers went to find more information.

Prepare Before the Next Vulnerability

At this rate, the next critical vulnerability is always just a few days away, and will create the same pressure if your team has to build its response from scratch. Stay ready so you don’t have to get ready. 

1. Assign an owner for vulnerability updates, including a backup.
2. Create your update template, or use the one below. You can find additional update templates in our help article.
3. • Status: Affected / Not affected / Investigating 
   • 1. Note: If your status is “Investigating” with a remediation date in the future, keep your update light on the details. Don’t give hackers an open invitation to pounce.
   • Scope: Which systems, products, or versions, and which customer data if any. 
   • Remediation: What you've done and what you're doing. 
   • Timeline: When you patched, or when you expect to, and when the next update posts. 
   • Contact: Who to reach, with a named owner.
3. Check that your updates subscriber list includes your top customers and your active prospects. A Trust Center update only works if the right people opted in.

If your security team’s vulnerability response still involves responding to customers one by one, Drata can help. Request a demo of Trust Center today and we’ll show you how to publish an update to subscribers in minutes, route remediation evidence to the right reviewers, and answer the questionnaire wave accurately, consistently, and quickly.