'Black October' vulnerability wave makes infrastructure inventory a board-level priority

Within a week PHP shipped emergency fixes for two pre-auth RCE flaws dating to 2004, Palo Alto Networks said every supported PAN-OS and Panorama version was vulnerable with no fix, and Cisco and Fortinet reviewed dozens of products. Some 79,680 CVEs were published from January 1 to October 13, 2.15 times the same period in 2025, pushing boards to demand a single live inventory of every device and version.

• 79,680 CVEs published from Jan 1 to Oct 13, 2.15x the same period in 2025
• Microsoft disclosed 1,408 vulnerabilities on Oct 13, more than all of 2025
• Only 26% of known-exploited vulnerabilities fully remediated, median 43 days
• Edge and security appliances accounted for 14% of exploited flaws, two-thirds high or critical