SOC 2 Startup Guide
SecurityTrust

Black October for a first-timer: the questions customers asked, and the trust center answer

By the Trailhead Desk · Published 2026-11-01

5 min read

Short answer

On 20 to 21 October 2026 the eMudhra certificate authority compromise, the PHP2Shell flaws and the Node2Shell flaw were disclosed within two days. Drata's figures for that week show customer trust center updates at 8x normal and subscriber emails at 13 times the week before. For a startup that has not finished its first SOC 2, the week is a preview of what customers will ask once the report exists: not "do you have a SOC 2" but "are you affected, and where is the statement". The answer is a trust center update with a status, a scope and a date.

What happened?

On 20 October The Register reported that private keys for eight intermediate certificate authorities run by eMudhra could be recovered; eMudhra left the TLS certificate business on 22 October. On 21 October PHP patched CVE-2026-109618 and CVE-2026-109619, together called PHP2Shell, rated 9.2 on CVSS v4.0, exploitable without authentication and fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Node.js patched CVE-2026-111497 the same day. CISA added the PHP flaws to its catalogue of exploited vulnerabilities with a federal deadline. Press and researchers called the month Black October.

What did customers do?

They asked. Drata published figures from its customers' trust centers for 19 to 23 October: vulnerability and incident updates up 8x, 36% of enterprise customers posting an update, most within 24 hours of the patches, 33,359 emails sent to trust center subscribers against 2,506 the week before, and subscriptions nearly doubling. The lesson Drata draws is that vulnerability response has a communications workload as well as a technical one, and that a single published answer saves the security team from answering the same email fifty times.

What should a startup have ready?

A trust center page with a vulnerability update template: status (affected, not affected, investigating), scope (which products and versions, which customer data if any), remediation (done and in progress), timeline (patched when, next update when) and a named contact. An owner for it, with a backup. A subscriber list that includes your top customers and active prospects. And one approved answer in your questionnaire knowledge base so every "are you affected by PHP2Shell" reply says the same thing. None of this needs the SOC 2 report to exist; all of it will be asked about during the audit as incident and communication evidence.

What do the five tools publish about this?

Scytale pre-fills its Trust Center from compliance data and says AI questionnaire answers are reviewed by a human expert. Vanta's Trust Center is on every plan, with questionnaire automation from the Plus plan. Secureframe's Trust Center is on Fundamentals, with questionnaire automation on Complete. Comp AI describes 1:1 Slack access to experts and, on its pricing page, says a trust center changes what is included in a quote. Thoropass does not describe a trust center on the pages we read. Only Drata, which is not in this guide's lineup, published usage figures for the week.

Where does this sit on the trail?

In the readiness stop, under incident response and communications. A first SOC 2 needs policies for incident management and for communicating with customers; a week like this is where the policy becomes a record. Our lesson on the first 90 days covers writing those policies; the playbook stop on after the report covers keeping the trust center current once the report is shared.

What should you do this week?

Pull up what your team sent to customers between 20 and 23 October, if anything. If the answer is nothing, write the template now and decide who owns it. If the answer is a dozen one-off emails, put the text on a page and point the next email at it.

Sources

Questions founders ask

Do I need a trust center before my first SOC 2 report?

You need a place to publish a status update and a list of who should receive it. Several platforms include a trust center on their entry plan, and the update itself becomes incident and communication evidence for the audit.

What should a vulnerability update say?

Status (affected, not affected, investigating), scope, remediation, timeline and a named contact. Keep technical detail out of the public version while you are still investigating.

Where to next on the trail

Your first 90 days

After the report

Scytale tool fit profile