November 2026 Patch Tuesday forecast highlights exploited PHP vulnerabilities
Original title: November 2026 Patch Tuesday forecast: Old software continues to bite
PHP2Shell exploited in the wild before patches; Broccoli2Shell emergency fix for .NET versions.
October 2026 Patch Tuesday released updates for record-breaking 1,202 CVEs including exploited PHP2Shell and .NET bypass issues. PHP2Shell allows attacker code execution on web servers without restart. Emergency Broccoli2Shell fixes address Brotli libraries in .NET 8, 9, 10 and RC3 for 11. Apple backported CoreGraphics fix to iOS 18.7.11 and iPadOS 18.7.11 for targeted attacks. Abandoned 2014 software runs on 2.5 million Windows devices.
Unconfirmed: Number of compromised servers and how attackers obtain root access unknown
- PHP2Shell exploited in the wild before patches
- Broccoli2Shell emergency fix for .NET 8-11
- Apple backported iOS 18.7.11 fixes for CVE-2026-86950
- Obsolete 2014 software on 2.5M Windows devices
- All fixes included in November Patch Tuesday
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-10839 | Open redirection vulnerability in the authentication system allows an attacker to use manipulated values in the X-Forwarded-Host header to alter the URLs… | 5.1 | <1% | ||
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |
| CVE-2026-111497 | Buffer overflow in Google Brotli decoder 1.0.3–1.2.0 | 9.2 | 83% | KEVPoC ×25 | KEV |
| CVE-2026-86950 | Out-of-Bounds Write in Apple CoreGraphics Enables Code Execution on iOS and macOS | 8.8 | 26% | KEVPoC ×3 | KEV |
| CVE-2026-96951 | Windows Shell command injection bypasses a security feature | 8.8 | 10% | KEV | KEV |
From the original article
5 min read at helpnetsecurity.com
How did you enjoy October 2026 Patch Tuesday? Were there enough CVEs reported to keep you busy for the rest of the year or are you finished and ready for another round next week? They released the regularly scheduled update nearly two and a half hours late, but Microsoft did resolve another record-breaking 1,407 unique CVEs.
helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.