Your patch list this week starts below your application, assuming your servers accept TCP connections. A use-after-free in the Linux IPv4 TCP stack, tracked as CVE-2026-98432 with a CVSS score of 9.8, got picked up on Hacker News on October 31. Same week: The Hacker News reported that the FBI officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned group also tracked as Jade Sleet. And Palo Alto Networks warned that attackers are exploiting the recently patched PHP2Shell flaws against publicly accessible management interfaces.
Three different layers with one gap in common: nobody has a current inventory of the thing being attacked. Kernel versions across a container fleet, which management interfaces answer from the internet, which custody path can move funds without a second approval. Those are answers you have written down somewhere, or you don't have them.
I do that mapping as a first milestone: kernel versions across your fleet, a staged patch and reboot plan, and a check that nothing is still running on an unpatched base image. A small service takes days, not months, and you get cost and timeline within a day.
If you want your fleet's kernel inventory mapped before you schedule the reboots, message me and I'll send a written estimate with the assumptions spelled out.