Microsoft shipped over 1,400 fixes and your patch SLA did not change
October 20, 2026. From issue 11 of The Compliance Brief, 3 stories for teams preparing for a first SOC 2 audit.
Issue 11 of The Compliance Brief was published on October 20, 2026. 3 of its 5 stories bear on the controls a SOC 2 audit tests, and they are below in short form. The full issue, with every take in full, is on traztech.ca.
Free weekly email
Get the next issue on Tuesday
One email a week: what changed in security and compliance, and what it means for teams preparing for a first SOC 2 audit.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.
Source: Krebs on Security
Microsoft released updates addressing more than 1,400 security vulnerabilities across Windows and other products. That beats September's record of nearly 1,000, which was already roughly ten times the usual monthly volume.
Our take, in short
Most SOC 2 and ISO programs I review promise critical patches inside seven days, written back when a Patch Tuesday was a hundred items. Two months of this volume and the policy becomes a finding waiting to happen, because the evidence will show you missed your own commitment.
Read the full take on traztech.ca
A Claude Code bug that quietly reads developer credentials
Source: Dark Reading
Researchers disclosed a flaw in the preview pane of Claude Code Desktop, dubbed SneakPeek, that allows an attacker to steal credentials from a developer machine without any click. Reported targets include SSH private keys, AWS credentials and Claude OAuth tokens.
Our take, in short
Developer laptops hold the keys to production, and AI coding tools now sit right on top of those keys with broad file access that nobody has threat modelled. If your engineers adopted these tools on their own, which they almost certainly did, you have unmanaged software in the most privileged part of your environment.
Read the full take on traztech.ca
OpenCode breach is a lesson in holding other people's API keys
Source: The Hacker News
OpenCode said an intruder reached a legacy system on the night of October 16 and may have exposed third-party AI provider keys that users had saved in OpenCode Console. Console is the optional hosted service where a workspace stores its own OpenAI, Anthropic or Google key so the platform can call the model provider on the team's behalf.
Our take, in short
Two things here. Storing a customer's credential for another service is custody, and it deserves the same controls you would put around their production data, which in practice means envelope encryption, narrow scoping and a rotation path you can trigger in an afternoon.
Read the full take on traztech.ca
Related on SOC2Prep
- Secure development policy for SOC 2
- SOC 2 checklist for a first audit
- SOC 2 CC4: monitoring your own controls
- SOC 2 acceptable use policy, minus the filler
Also in issue 11
Outside the controls a SOC 2 audit tests, but in the same email:
- Regulators are naming the service provider, not only the customer
- ConnectWise breach shows how app identities get you into someone else's tenant
Older: issue 10 All issues on SOC2Prep
Free weekly email
Get it every Tuesday
The next issue goes out Tuesday morning. Read it in your inbox instead of finding it here a week later.
Free. One email every Tuesday from Jacob Masse, and nothing else: signing up here does not add you to any other sequence. One click unsubscribes.