Rubrik’s October and early-November activity is mostly housekeeping with two hard deadlines inside it. This bulletin covers the Project Glasswing security fixes across CDM and RSC-P, the 4 November CDM patch builds, the move to a new software download endpoint, an HPE SSD firmware issue that degrades CDM performance after about seven and a half years of uptime, a new customer-managed KMS requirement for Cloud Cluster ES, and the latest Rubrik Security Cloud additions.

Do this one first: allowlist the new download endpoint

On 25 October 2026 Rubrik began moving software downloads to a new endpoint, rubrik-support-download-v3.s3.amazonaws.com. Nothing changed about how you request software in Rubrik Security Cloud or on the Rubrik Support Portal — but if your network blocks Amazon S3 endpoints, the download itself will fail.

This belongs at the top of the list because every other item below starts with downloading a package. Add the endpoint to your firewall and proxy allowlists before you schedule the patching window, not during it.

Project Glasswing: patch CDM and RSC-P, ignore RSC and RSC-G

Rubrik internally identified and fixed a set of high-severity security issues spanning RSC, RSC-G, RSC-P and CDM, and states that it is not aware of any exploitation of these issues in the field. No CVE identifiers were assigned, because the flaws were found in-house rather than reported from outside.

The name is worth explaining, because it is not a vulnerability codename. Project Glasswing is an Anthropic programme that gives organisations maintaining critical software infrastructure access to the Claude Mythos Research Preview, so they can find and fix vulnerabilities ahead of anyone else. Rubrik was granted access in June 2026 and has been running the model defensively across its own code since — CEO Bipul Sinha described it as “proactively purging potential vulnerabilities”. Rubrik went on to rebuild its code review pipeline around the model rather than scaling up human review: whole repositories scanned first, then narrower passes on the patterns that surfaced, with a dedicated team supplying business and security context and a deliberate decision to keep people in the loop on critical findings.

So this is not a breach notification. It is what it looks like when a vendor ships fixes ahead of disclosure — a better position than the alternative, but only if the patches actually get installed.

What you need to do depends entirely on how you consume Rubrik:

• RSC and RSC-G — no action. Rubrik delivers these fixes to its SaaS platforms directly.
• CDM — upgrade as soon as possible to 9.6.1-p2, 9.5.3-p4, 9.4.3-p8 or 9.3.3-p14, or later.
• RSC-P — upgrade as soon as possible to 2.6.9-p1 on Gen1, or 3.6.9 on Gen2, or later.

The three current CDM patch builds — 9.6.1-p2, 9.5.3-p4 and 9.4.3-p8 — were all released on 4 November 2026. If you are still on 9.3, then 9.3.3-p14 is your target.

Check the power-on hours on your HPE SATA SSDs

HPE has identified an issue in certain HPE SATA SSDs that severely degrades read and write performance once a drive passes 65,535 power-on hours — roughly seven and a half years.

If you run CDM on HPE hardware nodes, update the SSD firmware to the latest version available from HPE. This one is easy to miss because it presents as a gradual performance problem rather than a failure, and the trigger is simply age. A cluster commissioned in 2019 and left running is reaching that number about now.

Cloud Cluster ES upgrades now require a customer-managed KMS key

Rubrik is introducing a requirement for customer-managed KMS keys to encrypt cluster certificate packages in Rubrik Cloud Cluster Elastic Storage on AWS, Azure and GCP, strengthening protection of the cluster’s cryptographic material.

The requirement takes effect in CDM 9.3.3-p16, 9.4.3-p9, 9.5.3-p5 and 9.6.2. Upgrading an existing Cloud Cluster ES cluster to any of those versions or later will require a KMS key to be in place first. Worth provisioning the key now rather than discovering it mid-upgrade.

PHP2Shell: Rubrik is not affected

On 21 October 2026 the PHP project disclosed two critical vulnerabilities, collectively named PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Both allow an unauthenticated attacker to execute code remotely on servers that use PHP to handle web requests.

None of Rubrik’s products include or use PHP to serve requests, so no customer action is required. If PHP2Shell is on your remediation tracker, Rubrik can be marked not applicable.

Protect your archival tier from its own lifecycle policies

This is the item most likely to be quietly true in an environment right now. External lifecycle policies applied directly to Azure or Amazon S3 Data Center archival locations — policies that delete non-current object versions, or move data to offline tiers such as S3 Glacier or Azure Archive — can cause data loss, prevent recovery, halt new backups, and leave the archival location in a state with no automated remediation path.

Rubrik can now detect these harmful configurations so you can review and disable them before further damage occurs. Detection is not automatic, though. To enable it, switch archival locations that use access keys over to cloud accounts, and update the permissions granted to Azure service principals or AWS IAM roles in those cloud accounts, so that Rubrik has the visibility it needs to inspect and alert on cloud storage policies.

If a storage team set a lifecycle rule on that bucket for cost reasons, nobody told the backup team, and nothing has needed restoring since, this is how you find out before a restore does.

New in Rubrik Security Cloud

Support case management. Rubrik Support cases now live in RSC. From the Support Cases page in the apps menu you can create cases, see active and resolved cases in one table, add comments, upload files, request escalations, and close or reopen cases without leaving the console. Customers with Rubrik AI enabled can also open a case through it. Customers who access Rubrik products through a partner should continue to file support cases through that partner.

Personal access tokens. RSC now supports PATs: user-managed API credentials that inherit the owner’s roles and attribute every API action to that user. Users with PAT permissions can create, rotate and deactivate their own tokens, and administrators can oversee them. If you have shared service-account credentials sitting in scripts, this is the replacement.

Rubrik MCP server. The Rubrik Model Context Protocol server exposes Rubrik Security Cloud to AI agents. It runs locally — on a workstation or on an agent’s server — alongside the AI agent that connects to it, and translates tasks described in plain language into GraphQL operations against your RSC tenant: querying workloads, checking compliance, triggering backups. It is built for administrators and automation teams who build their own integrations.

Need a hand sequencing the CDM upgrade?

Arrosoft can check your current CDM and RSC-P builds against the Project Glasswing targets, confirm the new download endpoint is reachable from your network, review your archival locations for external lifecycle policies, and plan the upgrade window around your backup schedule. Get in touch.

Background: Rubrik gains access to the Anthropic Mythos Research Preview under Project Glasswing (2 June 2026), and Rubrik rebuilds its code review pipeline after the model finds numerous security flaws. Target builds, the download endpoint change and the Cloud Cluster ES KMS requirement come from Rubrik’s own release notes and support portal.