SCHEMASEC — EXPOSURE CHECKLIST
Source snapshot: 22 October 2026. Recheck vendor guidance before acting.

This is a self-check, not a scan, certification or security clearance.

1. Inventory named deployments, technical owners and authorization.
2. PHP / WordPress: obtain the actual serving runtime and host patch evidence.
   https://wordpress.org/news/2026/10/critical-php-security-release/
3. Node.js: verify deployed runtime and image versions against the vendor release.
   https://nodejs.org/en/blog/vulnerability/october-2026-security-releases
4. Self-managed GitLab: confirm patch evidence and supported upgrade path.
   GitLab.com was already patched in this vendor notice.
   https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/
5. Railway: follow current rotation and log-review recommendations. Map consumers first.
   https://blog.railway.com/p/security-disclosure-wednesday-october-21st
6. Verify MFA enforcement and privileged-account ownership.
7. Document an isolated backup restore test and recovery owner.
8. For every change: authorization, backup, rollback, window, acceptance test and retest evidence.

Mark unknowns as unknown; a vendor notice does not prove your business was compromised.
If you suspect an active incident, contact your established incident-response provider.
Never email passwords, keys, customer records or sensitive logs.

Scoped audits from $995; remediation from $1,500, separately scoped.
projects@schemacorp.com
Intended public page: https://schemacorp.com/security/