Who Holds the Keys to Your Patching?

Sat, 31 Oct 2026 00:00:00 +0000

On 21 October, details of two critical PHP flaws leaked to VirusTotal at 02:29 UTC. By 07:34, hosting providers were reporting active exploitation, and PHP released the fix at 13:52, according to Recorded Future. Amazon later said the first exploitation attempts started on 17 October, four days before any patch existed.

In Patch Less I argued that the long tail of utilities on user devices should be patched automatically, with a third-party tool or Microsoft’s own catalogue. Timelines like this one are the reason. But that automation raises a question I keep coming back to: when you hand patching to a third-party tool, whose keys are you handing over?

Zero Trust on Phillip Büchler

Who Holds the Keys to Your Patching?