November 2026 Patch Tuesday forecast: Old software continues to bite

How did you enjoy October 2026 Patch Tuesday? Were there enough CVEs reported to keep you busy for the rest of the year or are you finished and ready for another round next week? They released the regularly scheduled update nearly two and a half hours late, but Microsoft did resolve another record-breaking 1,407 unique CVEs.

As in previous months, there were limited CVEs we needed to immediately deal with. In October, one zero-day CVE-2026-96951 was confirmed exploited; it was a Windows Shell security feature bypass impacting Windows 10, Windows 11 and Windows Server. And CVE-2026-10839 was publicly disclosed; it was a .NET Framework security bypass vulnerability. Overall, there were 78 Critical vulnerabilities, which was a small fraction of all CVEs reported.

PHP2Shell

The hottest news of the month surrounded vulnerabilities CVE-2026-109618 and CVE-2026-109619, also referred to as PHP2Shell by researchers. PHP is a general-purpose scripting language which was originally released in 1994 to support web development. It runs on a server providing the middleware between a web server and the browser requesting information.

PHP released a security advisory on October 21st regarding the vulnerabilities and the related PHP software versions that had been fixed. Exploitation in the wild was detected several days before the patches were released and is continuing to expand. Patching the vulnerability is a multi-step process varying by operating system, but essentially, you need to replace the php runtime, stop the web server and then restart it all. Without a restart, the old code stays in memory.

Exploitation of the vulnerability provides the attacker with access to whatever the php shell can see. Keep this in mind as you assess your systems for compromise and prioritize the updates.

Emergency fixes

Microsoft had several out-of-band releases and the usual preview patch near the end of last month, both of which have security implications. They released an emergency fix for CVE-2026-111497 on October 25, which is also referred to as the Broccoli2Shell, Node2Shell or HTTP2Shell vulnerability. This name comes from a flaw in the Brotli binaries or libraries used to process Brotli-compressed data. These fixes address the libraries in .NET 8, 9, 10, as well as Release Candidate 3 for .NET 11 and should be updated as soon as possible. There is proof-of-concept code available but no known exploitation in the wild at this time.

On October 26, Microsoft issued an update that removes seven certificates from the Windows trust list: six eMudhra G3 roots and an AAA Certificate Services cross-sign. These certificate keys had been compromised. And finally, Microsoft confirmed the preview patches included fixes for the Always On VPN connection failures, which were introduced back with the September Patch Tuesday updates. They also included a fix for the Smart App Control broken by the October Windows update.

Following application of that October update, the Smart App Control option was grayed out and could not be toggled on affected devices running Windows 11 24H2 and later. All of these security fixes will be included in the November Patch Tuesday cumulative release.

Obsolete software

Do you spend time finding and removing EOL or obsolete software in your environment? Although it isn’t strictly a patching issue, we often leave software in place after applying its final patches, intending to remove it later. But do we always remember, or find the time? One article described an abandoned 2014 application that was still running and trying to update itself on 2.5 million Windows devices and 300,000 Macs. Several of the domains it contacted for updates were open for new registration, so anyone paying attention could have created a malicious update package that would instantly compromise millions of machines. Fortunately, the problem was detected and the software removed before that could happen, but this software was running for a long time.

This begs the question, do we really know what every running service on our machines is doing, particularly those with network connectivity? This is yet another area where AI can provide more insight into operational vulnerabilities on our systems. And yes, we do need to constantly search for and remove obsolete software from our systems or face the consequences.

Updates from Apple

Apple released major security updates for all its supported operating systems on October 26th. For example, the security update for its latest version, macOS Golden Gate 27, addressed 183 unique CVEs. You should also note on this page that there are updates for iOS 18.7.11 and iPadOS 18.7.11. Apple backported a fix to these operating systems because of the known exploited CVE-2026-86950. Per Apple: “Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.” Exploitation of this CoreGraphics vulnerability could lead to arbitrary code execution. If you are running these older OS versions, you should take advantage of this rare patch from Apple.