November 2026 Patch Tuesday lists 1,094 flaws, one exploited
The available text is mostly site navigation and does not name the exploited flaw or affected products.
Stories per day · 30 days
3 RSS
Relatedvulnerability-management3php2bitsight1brotli1bug-finding1cisa1cyber-resilience-act1deployment1disclosure1embargo1enisa1eu1europol1google-cloud1investment-fraud1kev1known-exploited1linux-kernel1
50 stories, newest first · one card per story
Stories tagged #patch-management
ENISA: 45% of surveyed EU IT providers take months to patch
The EU Cybersecurity Index averages 71.53, but ENISA says the figure is not comparable with 2024 and does not show supplier patch speed.
Linus Torvalds sees AI-prompted patch flood peak
Linux kernel developers report AI-found fixes now outpacing new bug reports in some areas, suggesting the patchpocalypse is easing.
1
ThreatsDay covers fraud arrests, slow patching and a $250K cloud bounty
Europol says seven arrests and more than 100 seized servers followed fraud losses of at least $4.5 million.
1
Blog argues rapid disclosures leave defenders unable to keep up
A week of KVM, PHP, CA, and Brotli issues shows fixes arrive faster than inventory, assessment, and rollout.
1
Tenable outlines detection and patching for PHP2Shell
CVE-2026-109618 and CVE-2026-109619 affect PHP, which Tenable says runs on more than 70% of websites.
Miren maps a week of incidents to three system-design risks
The deployment vendor cites Railway, Zeabur, PHP, GitLab, Node.js, LiteLLM and OVH while promoting its open-source control plane.
1
Known exploited flaws take a median 87 days to patch, Moody's says
Flaws without known exploitation take 107 days at the median, using February 2026 Bitsight data.
1
Qualys introduces TruConfidence to orchestrate cyber risk remediation
Qualys launched TruRisk Eliminate 2.0 with TruConfidence to orchestrate automated vulnerability remediation.
Top RCE Vulnerabilities
SOCRadar ranks current remote code execution flaws, noting nine of ten are in CISA's KEV catalog.
Microsoft: Windows 11 23H2 reaches end of support in 30 days
Microsoft announced Windows 11 23H2 Enterprise, Education, and IoT editions reach end of support in November 2026, urging upgrade to 26H2.
3
MongoDB security advisory (AV26-1024)
Canadian Cyber Centre advisory urges updating MongoDB Go Driver before 2.9.0/2.9.2 and libmongocrypt before 1.20.5 to fix BSON parsing and KEK issues.
Microsoft: Outdated Windows devices will stop receiving security updates
Unsupported Windows devices will lose security updates after Windows Update certificates expire in 2027.
Qualcomm security advisory (AV26-1013)
Canada's Cyber Centre points administrators to Qualcomm's October 2026 security bulletin and urges applying updates.
How to secure RMM software: 8 controls MSPs should test
An Acronis-backed checklist tells MSPs to test eight RMM controls, citing N-able and SharePoint flaws.
CVE flood pushes Ubuntu onto weekly kernel release cycle
Canonical will ship Ubuntu kernel updates weekly after AI-assisted hunting and kernel CVEs outpaced its patch cycle.
Ubuntu kernel CVE fixes are moving to a weekly release schedule
Canonical will ship Ubuntu kernel updates weekly by overlapping two-week cycles, with uncertified -proposed builds for faster CVE fixes.
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added two actively exploited Linux kernel flaws, CVE-2025-39964 (race condition) and CVE-2026-53266 (out-of-bounds write), to its KEV Catalog.
2
Android Apps Can Now Check If Your Phone Is Missing Critical Security Patches
Google releases Android Security State libraries letting apps and enterprise tools verify component-level security patch status across system, Mainline modules, and kernel.
Android apps can now check security patches down to individual device components
Google shipped stable AndroidX Security State libraries letting Android apps check per-component patch levels and CVE patch status via OSV data.
CISA Ditches Weekly Vulnerability Roundups for Risk-Based Focus
CISA is discontinuing its weekly vulnerability roundups, shifting to risk-based guidance that prioritizes the vulnerabilities that matter most.
Windows 11 KB5124008 update breaks domain trust for some users
Microsoft is investigating Windows 11 KB5124008 breaking Active Directory domain trust, leaving some users unable to log in with valid credentials.
3
Oracle September 2026 Critical Security Patch Update addresses 672 CVEs
Oracle's September 2026 CSPU fixes 672 CVEs across 673 patches, including 104 critical updates, with E-Business Suite receiving the most patches (159).
2
Microsoft releases emergency Windows updates to fix RDS failures
Microsoft released emergency out-of-band Windows updates fixing Remote Desktop Services failures and Hyper-V issues caused by September 2026 security patches.
4