In partnership with
| Website Security
Your Website Is a Front Door. Who Is Locking It?
Hi there,
This week CISA added a flaw in WordPress itself to its list of vulnerabilities attackers are actively using. It lets someone with no login run code on your web server while the site is updating. WordPress fixed it in version 7.1.4 on October 28, and CISA wants it patched by November 6.
Plenty of practices and small businesses run their site on WordPress and have never decided who keeps it updated. Your website often holds more than you'd guess: contact and intake forms, appointment requests, a portal login. Three questions to answer this week:
Who updates your site? Name the person or vendor, and confirm they've installed WordPress 7.1.4 or later.
What do your forms collect? If a form takes health information, it needs to be secured, and the vendors behind it likely need a signed business associate agreement.
Is your website in your risk analysis? It should be, along with its plugins, its hosting and everyone who has admin access.
| This Week's CVEs from CISA
One new addition to CISA's Known Exploited Vulnerabilities (KEV) catalog since Tuesday, plus two from late October we're catching up on. All three are being used in real attacks.
CVE-2026-119977 | WordPress Core. Someone with no login can run code on your web server during a core update. Update to WordPress 7.1.4, or apply the vendor mitigation, and check for signs of compromise. KEV due date: November 6, 2026.
CVE-2026-111497 | Google Brotli (a compression library built into browsers, web servers and many apps). A booby-trapped compressed file can leak memory, crash the app or possibly run code. Patch or apply the vendor mitigation as your software vendors ship fixes. KEV due date: November 10, 2026.
CVE-2026-48356 | Adobe Commerce and Magento. Attackers can upload a malicious file to an online store and run code on it. Patch or apply the vendor mitigation. KEV due date: November 10, 2026.
For our energy clients: CISA published an advisory for Subnet Solutions PowerSYSTEM Center (CVE-2026-63017 and CVE-2026-63774). It isn't on the exploited list, and the fix is 2020 Update 30 or 2026 Update 1.1.
Why it matters for HIPAA: your risk analysis should cover public-facing systems like your website, and your patch management records should show when each fix went in.
| Framework Spotlight
ISO 27001: What Certification Actually Looks Like
ISO/IEC 27001 is the international standard for an information security management system, or ISMS. Where SOC 2 ends in a report, ISO 27001 ends in a certificate, and it's often the one international customers and partners ask for.
Getting there runs in two parts. First you build the ISMS: set your scope, assess your risks, pick your controls (the 2022 version lists 93 in Annex A), then run it long enough to complete an internal audit and a management review. Then an accredited certification body audits you in two stages, first your documentation and readiness, then whether the system works in practice.
The certificate isn't one and done. Expect surveillance audits each year and a full recertification audit every three years.
The most common mistake we see is scoping too broadly on day one. Start with the systems and teams your customers actually care about.
On the podcast: If you haven't heard it yet, "Compliance, Elevated: The Next Chapter of VanRein" is a 21-minute listen on where VanRein is headed and what it means for your compliance program.
Your AI risk: Your website isn't the only place data slips out. The AI Exposure Score is a 2-minute check of where your team's AI use could be exposed.
We Can Help
Not sure who's patching your website, or whether it belongs in your risk analysis? We'll help you sort out who owns it, what it collects and which vendors need to sign a BAA. Reply to this email or book a time below.
Thanks for reading, and for trusting us with your compliance.
Rob and Dawn Van Buskirk
Co-founders, VanRein Compliance
Compliance, Elevated.
Find what’s slowing your GTM.
Most GTM problems aren’t one big failure. They’re one or two weak spots quietly dragging down the rest.
The free GTM Audit scores your go-to-market across four dimensions, then sequences a 90-day roadmap for your stage.
Drop your URL. Get your score in about 10 minutes.
