Black October was a trust center test. What a switcher should check before moving

What happened in late October?

On 20 October The Register reported that private keys for eight intermediate certificate authorities operated by eMudhra were weak enough to recover; eMudhra said on 22 October it was leaving the TLS certificate business. On 21 October PHP shipped emergency patches for two critical remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, scored 9.2 on CVSS v4.0 and known together as PHP2Shell, fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. The same day Node.js patched CVE-2026-111497, an out-of-bounds write in its Brotli decoder. CISA added the PHP flaws to its Known Exploited Vulnerabilities catalog with a patching deadline for federal agencies. The press called the month "Black October".

What did vendors' trust centers do?

Drata published the only platform-wide figures we found. For 19 to 23 October it reported an 8x increase in vulnerability and incident updates published in Drata trust centers, 36% of enterprise customers publishing an update, most within 24 hours of the patches, 33,359 emails sent to trust center subscribers against 2,506 the week before, and subscriptions nearly doubling week over week. Drata's own trust center shows the pattern: a Node.js update stating production services were patched as of 23 October, and an eMudhra statement on 27 October. We did not find comparable figures from the other seven vendors in our lineup; their trust center pages describe features, not usage.

Why does this matter for a switch?

Because the trust center is the part of a SOC 2 platform your customers see. Our trust center and questionnaires criterion scores what vendors publish about it: Vanta's Trust Center is on every plan with questionnaire automation from Plus; Drata's Trust Center Standard is on Foundation; Secureframe's Trust Center is on Fundamentals with questionnaire automation on Complete; Scytale pre-fills its Trust Center from compliance data. None of those facts tells you whether the update you need to post at 9pm on patch day goes out to the right people in minutes. That is the thing to test.

What should you test before moving?

Five things, in the trial account. Post a test update and see who is notified and how fast. Check whether subscribers from your current platform can be imported, and whether you can email a custom list you already hold permission for. Check whether an update can be scoped so technical detail reaches reviewers under NDA while the public sees status only. Check that the questionnaire knowledge base can hold one approved answer for "are you affected by X" so every response matches. Check what analytics you get afterwards: views, downloads, access requests, questionnaire volume.

What does a switch cost you here?

Your subscriber list and your update history. A trust center is a published record, and buyers who subscribed to the old URL will not follow you automatically. Before you switch, export the subscriber list, note the custom domain, and plan the redirect. Our switch guide on rebuilding your trust center and questionnaire library covers the sequence.

Does this change our scores?

No. Usage figures from one vendor are not comparable to feature lists from seven. We have added the five tests above to the trust center section of the switch planner, so they appear whenever that criterion is weighted.

What else should a switcher know?

What was Black October?

The name given to a cluster of security disclosures in late October 2026: the eMudhra certificate authority key compromise (20 October), the PHP2Shell remote code execution flaws (21 October) and the Node2Shell flaw in Node.js (21 October).

Which SOC 2 platform handled Black October best?

We cannot rank that. Drata is the only vendor that published platform-wide figures for the week; the others describe trust center features but not usage.