{"id":95676,"date":"2026-11-11T12:01:49","date_gmt":"2026-11-11T11:01:49","guid":{"rendered":"https:\/\/www.skaylink.com\/?p=95676"},"modified":"2026-11-11T12:06:40","modified_gmt":"2026-11-11T11:06:40","slug":"keeping-systems-up-to-date-is-security-control","status":"publish","type":"post","link":"https:\/\/www.skaylink.com\/en\/insights\/blog\/keeping-systems-up-to-date-is-security-control\/","title":{"rendered":"Keeping systems up to date is a security control, not a chore"},"content":{"rendered":"\t\t
\n\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Home<\/a><\/span><\/span><\/p>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Blog<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Keeping systems up to date is a security control, not a chore<\/h1>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tAutomatic security updates are important, but they aren’t enough on their own. Learn why supported operating systems and complementary AWS security services are crucial for protecting your systems.\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\tNovember 11, 2026\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\t\t\"Picture\n\t\t\t\t<\/div>\n\t\t\t\n\t\t\t
\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t\n\t\t\t\t\t\t\tStefan Heitm\u00fcller\t\t\t\t\t\t<\/span>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t\t\t
\n\t\t\t\t\t\t

Senior Cloud Architect<\/p>\n\t\t\t\t\t<\/div>\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t

\n\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t
\n\t\t\t\n\t\t\t
\n\t\t\t\t\n\t\t\t\t\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t
\n\t\t\t\t\t
\n\t\t
\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

October 2026 showed how quickly a working server can become an open door for attackers. In just one week, two critical vulnerabilities came to light: PHP2Shell and Node2Shell. Both can allow attackers to run their own code on affected systems, and both were actively exploited shortly after disclosure.<\/p>

The good news for our customers is that much of the protection is already in place. We automatically apply security updates to the systems we manage for you. However, automatic updates have their limit: they can only install patches that are available. Once an operating system reaches end of life (EOL), it no longer receives security patches, and that\u2019s where the risk begins.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

What happened<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

PHP2Shell (CVE-2026-109618, CVE-2026-109619) refers to two memory-safety vulnerabilities in the PHP interpreter. They affect PHP versions 5.4 through 8.5, spanning more than a decade of releases. An unauthenticated web request can execute code on the server or access sensitive information in memory such as passwords, tokens, and keys. Because the flaws exist in the PHP runtime rather than in the application code, even well-written applications can be affected. The US Cybersecurity and Infrastructure Security Agency (CISA) lists both vulnerabilities in its Known Exploited Vulnerabilities (KEV) catalog.<\/p>

Node2Shell (CVE-2026-111497) affects Brotli, a widely used compression library. Specially crafted compressed data, such as data contained in a request or response, can cause a process to crash, expose sensitive information in memory or allow attackers to execute arbitrary code. Node.js bundles Brotli, but it\u2019s also distributed as a system library and used by many other applications. CISA added this vulnerability to its KEV catalog on October 27, 2026.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

How we protect your systems<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

We run your environment on AWS, including orchestration, deployment, and configuration. On every system we manage, security updates are automatically installed using unattended-upgrades. When the operating system vendor publishes a fix, it reaches your servers without any action required on your part. For PHP2Shell and Node2Shell, this meant that systems running supported OS releases received the patched packages shortly after they became available through their distributions.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Where automatic updates stop<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Automatic updates keep a system up to date within its current OS release. They don\u2019t upgrade it to a newer release. Upgrading can affect runtime versions, libraries, and system behavior, which is why careful planning and testing with you are essential.<\/p>

Running an EOL operating system has three major consequences:<\/p>