November 2026 Patch Tuesday: PHP2Shell and .NET Brotli

As engineering teams prepare for the patch tuesday november 2026 deployment cycle, systems administrators face an accumulation of high-risk vulnerabilities spanning web runtimes, core operating systems, and compression libraries. October closed with record security update volumes, topped by active exploitation of PHP2Shell vulnerabilities and emergency out-of-band updates for Microsoft .NET infrastructure.

Remediation demands more than standard package updates. Operating web application fleets, Windows enterprise endpoints, and Apple mobile devices requires tailored operational protocols—such as mandatory process restarts for PHP environments and manual verification of certificate revocation lists. Applying updates without flushing process memory or auditing background dependencies leaves systems vulnerable despite reports of completed patches.

This technical analysis breaks down the root mechanisms of recent advisories, provides precise remediation commands across Linux and Windows environments, and details execution steps to secure infrastructure ahead of November’s cumulative update release.

October Retrospective: Managing Unprecedented CVE Volumes

The October 2026 patch cycle established a historical baseline for operational volume. Microsoft resolved 1,407 unique Common Vulnerabilities and Exposures (CVEs), a release delivered nearly two and a half hours behind schedule. Out of the total volume published by Microsoft, 78 vulnerabilities were classified as Critical based on their potential for remote code execution or network-wide privilege escalation.

Priority management during the October cycle centered on two Windows vulnerabilities requiring immediate triage:

• CVE-2026-96951: An actively exploited zero-day Windows Shell security feature bypass affecting Windows 10, Windows 11, and Windows Server platforms. The vulnerability allows attackers to bypass core security controls executed by the shell subsystem when users interact with untrusted file payloads.
• CVE-2026-10839: A publicly disclosed .NET Framework security bypass vulnerability. Although public disclosure occurred prior to Patch Tuesday, active exploitation in the wild was not identified at release. The flaw allows unauthenticated remote callers to subvert framework-level security checks under specific execution contexts.

The root-cause execution mechanics of the Windows Shell bypass CVE-2026-96951 have not been disclosed by Microsoft. Systems administrators cannot rely on signature-based network detection alone; remediation requires verified deployment of the October cumulative update across all endpoint and server populations.

The operational burden of processing over 1,400 security fixes highlighted a persistent challenge for Patch Management and SRE teams: filtering noise to isolate zero-day threats from routine fixes. While the percentage of Critical CVEs remained small relative to the overall release volume, the requirement to validate, test, and stage updates across hybrid environments created significant deployment backlogs leading directly into November.

PHP2Shell Breakdown: CVE-2026-109618 and CVE-2026-109619 Mechanics

On 21 October 2026, the PHP Group issued a security advisory covering two severe flaws tracked as CVE-2026-109618 and CVE-2026-109619, collectively designated by security researchers as PHP2Shell. Active exploitation in the wild was detected several days prior to the public advisory release and has expanded across internet-facing web applications.

PHP serves as the runtime middleware between web servers (such as Apache HTTP Server, NGINX, or IIS) and client browsers. When exploited, PHP2Shell grants the attacker arbitrary execution capabilities within the context of the underlying PHP process. The privilege boundary of an exploited PHP shell matches the execution context of the worker process—typically www-data on Linux distributions, nginx, or dedicated IIS Application Pool identities on Windows Server systems.

To fully remediate PHP2Shell, operational teams must execute a strict three-step sequence across all web nodes:

1. Binary Replacement: Update the base PHP package binaries to the patched versions specified in the 21 October advisory.
2. Process Shutdown: Issue a full termination command to the web server process and FastCGI Process Manager (PHP-FPM) to terminate all active worker threads.
3. Service Restart: Execute a clean daemon start to force the loading of patched runtime libraries from disk into system memory.

The sequence below illustrates the remediation workflow on an Enterprise Linux system operating NGINX with PHP-FPM:

# Step 1: Update PHP package binaries (test in staging first)
sudo dnf update -y php php-fpm php-cli

# Step 2: Stop PHP-FPM and web server daemons to flush resident memory
sudo systemctl stop php-fpm
sudo systemctl stop nginx

# Step 3: Verify no orphaned PHP worker processes remain in memory
ps aux | grep -E '[p]hp-fpm|[n]ginx'

# Step 4: Restart services with fresh binary references
sudo systemctl start php-fpm
sudo systemctl start nginx

# Step 5: Validate runtime execution binary reference
lsof -p $(pgrep -f php-fpm | head -n 1) | grep libphp

In environments running IIS on Windows Server hosting PHP via FastCGI, administrators must execute an application pool recycling command and restart the World Wide Web Publishing Service:

# Stop IIS service to release locked DLL handles
Stop-Service -Name W3SVC -Force

# Kill any orphaned php-cgi.exe worker processes
Get-Process -Name "php-cgi" -ErrorAction SilentlyContinue | Stop-Process -Force

# Start IIS service to initialize clean worker processes
Start-Service -Name W3SVC

# Verify running binary path for active CGI workers
Get-CimInstance Win32_Process -Filter "name='php-cgi.exe'" | Select-Object ProcessId, ExecutablePath

Failing to execute an explicit service restart leaves web application nodes completely exposed to active exploit traffic targeting PHP2Shell, regardless of whether operating system update status displays fully patched packages.

Emergency .NET Fixes: Dissecting Brotli Flaw CVE-2026-111497

On 25 October 2026, Microsoft issued an out-of-band security update to address CVE-2026-111497, a critical memory safety flaw identified in the Brotli compression library implementation within the .NET runtime. The vulnerability is known across industry advisories under the names Broccoli2Shell, Node2Shell, and HTTP2Shell.

The flaw resides in the internal processing routines used to decompress stream-based HTTP payloads and data structures formatted with Brotli compression algorithms. An attacker capable of submitting a specially crafted, compressed payload to a vulnerable target service can trigger memory corruption, potentially leading to remote code execution or application crash conditions (denial of service).

The scope of affected .NET runtimes encompasses both long-term support and preview builds:

Runtime Family	Vulnerability Status	Required Action
.NET 8.0	Vulnerable (CVE-2026-111497)	Apply 25 October Out-of-Band Update
.NET 9.0	Vulnerable (CVE-2026-111497)	Apply 25 October Out-of-Band Update
.NET 10.0	Vulnerable (CVE-2026-111497)	Apply 25 October Out-of-Band Update
.NET 11 (Release Candidate 3)	Vulnerable (CVE-2026-111497)	Upgrade to patched RC build

Public proof-of-concept (PoC) exploit code for CVE-2026-111497 is available across security repositories. However, active exploitation in the wild has not been detected at the time of publication. Despite the lack of wild exploitation, security teams must deploy this out-of-band patch immediately rather than waiting for November’s cumulative update release, as public PoC availability significantly shortens the exploitation window for internet-accessible services.

The full roster of non-.NET third-party applications bundling unpatched Brotli dynamic libraries has not been disclosed. Security teams must run system-wide software inventory scans to locate embedded or static distributions of vulnerable Brotli dynamic link libraries (brotli.dll or libbrotli.so) packaged within third-party vendor binaries.

# Linux diagnostic script to identify active .NET runtime versions
dotnet --list-runtimes

# Search local file systems for standalone unmanaged Brotli shared objects
find / -name "libbrotli*.so*" 2>/dev/null

# PowerShell diagnostic script for Windows hosts
Get-ChildItem -Path "C:\Program Files\dotnet\shared\Microsoft.NETCore.App" -Directory | Select-Object Name

# Scan application directories for unmanaged native Brotli DLLs
Get-ChildItem -Path "C:\Program Files" -Filter "brotli.dll" -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime

Trust Infrastructure Changes: Windows Certificate Revocations

Microsoft executed an out-of-band Windows Certificate Trust List (CTL) modification on 26 October 2026. This administrative update removed seven trusted certificates from the global Windows trust store following confirmed reports of key compromises.

The revoked certificates comprise:

• Six eMudhra G3 Root Certificates: Primary root anchors supporting digital signatures, TLS server authentication, and client authentication chains.
• One AAA Certificate Services Cross-Sign Certificate: Interoperability bridge certificate linking legacy public key infrastructures (PKI) to established trust anchors.

When private keys corresponding to root or cross-signed certificates are compromised, attackers possessing those keys can mint cryptographically valid leaf certificates for any domain, host, or organization without authorization. Cryptographic validation by operating systems or web browsers will succeed unless the parent certificate is explicitly removed from the system Certificate Trust List.

The total count of enterprise TLS connections impacted by the eMudhra G3 root certificate revocations prior to removal has not been disclosed by Microsoft. Organizations executing mutual TLS (mTLS) for microservice communications, internal VPN gateways, or legacy B2B integration endpoints using eMudhra certificates will experience immediate transport-level connection drops following the update.

Administrators responsible for isolated networks can verify CTL revocation status and manually push CTL updates using the following commands:

# Verify presence of revoked certificates in the Windows LocalMachine Root Store
Get-ChildItem -Path Cert:\LocalMachine\Root | Where-Object { $_.Subject -like "*eMudhra*" -or $_.Subject -like "*AAA Certificate Services*" } | Select-Object Thumbprint, Subject, NotAfter

# Force update of Windows Certificate Trust List (Test in Staging environment first)
certutil.exe -generateSSTFromWU C:\Temp\Roots.sst
Import-Certificate -FilePath C:\Temp\Roots.sst -CertStoreLocation Cert:\LocalMachine\Root

Apple Zero-Day Remediation: CoreGraphics CVE-2026-86950 Backports

On 26 October 2026, Apple issued comprehensive security updates across all supported operating system branches. The flagship release for modern Mac hardware, macOS Golden Gate 27, resolved 183 unique vulnerabilities. Simultaneously, Apple issued targeted security updates for older mobile operating system platforms, releasing iOS 18.7.11 and iPadOS 18.7.11.

The primary driver for the legacy mobile backports was CVE-2026-86950, a critical flaw within the CoreGraphics framework. Processing a maliciously crafted image file via CoreGraphics can allow an attacker to bypass memory protections and trigger arbitrary code execution on the target device.

According to Apple’s official security advisory, CVE-2026-86950 has been actively exploited in the wild in extremely sophisticated targeted attacks directed against specific individuals running versions of iOS prior to iOS 27. Specific threat actor groups executing targeted exploits against iOS CVE-2026-86950 have not been disclosed by Apple.

Backported patches for older mobile operating system branches are rare. Systems administrators overseeing Mobile Device Management (MDM) platforms must enforce immediate compliance policies for legacy iPhone and iPad hardware incapable of upgrading to iOS 27.

Platform	Target Version	Resolved Vulnerability Count	Critical Focus Area
macOS Golden Gate	Version 27	183 CVEs	Broad OS, Kernel, and Subsystem Hardening
iOS / iPadOS	Version 18.7.11 (Backport)	Select Security Backports	CVE-2026-86950 CoreGraphics Zero-Day

Mobile security policies should require connected endpoints to demonstrate build verification for iOS 18.7.11 or iOS 27 prior to permitting access to enterprise mail, messaging, and internal web applications.

Windows 11 24H2 Regression Fixes: Smart App Control and VPNs

Late October preview updates for Windows addressed operational regressions introduced in prior Patch Tuesday cumulative updates. These functional fixes are queued for integration into the upcoming November 2026 cumulative release, making pre-deployment validation essential for enterprise infrastructure teams.

Key non-security regressions resolved include:

• Always On VPN Connection Failures: Resolves remote access service connection drops originally introduced in the September 2026 security updates. Affected enterprise clients failed to establish automated IKEv2 or SSTP tunnels back to corporate concentrators.
• Smart App Control UI Lockout: Resolves an administrative flaw introduced in the October cumulative update for Windows 11 version 24H2 and higher. Following the update, the Smart App Control configuration toggle was grayed out, preventing security operations teams from enabling or modifying application enforcement states.

Organizations that delayed deploying the September or October cumulative updates due to VPN instability or administrative UI lockouts can safely validate these preview fixes within target deployment rings ahead of the November Patch Tuesday release.

# Verify Windows 11 Version and Build Number
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion" | Select-Object DisplayVersion, CurrentBuild, UBR

# Check Smart App Control (SAC) Registry Status
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\CI\Policy" -Name "VerifiedAndReputablePolicyState" -ErrorAction SilentlyContinue

Legacy Software Auditing: Mitigating Abandoned Asset Risks

A recent security research discovery underscored systemic risks present in unmanaged legacy software environments. Investigators identified an abandoned application originally compiled in 2014 actively executing across 2.5 million Windows devices and 300,000 macOS systems worldwide.

The abandoned software regularly initiated automated outbound network requests to hardcoded update domains to check for replacement binaries. Analysis of the domain infrastructure revealed that several primary update domains referenced in the legacy code had lapsed, expired, and were open for public registration.

Although the specific application was retired before exploitation occurred, the event highlights the necessity of continuous software asset inventory and automated decommissioning protocols. Security teams cannot rely strictly on CVE patching; end-of-life (EOL) software must be uninstalled to prevent orphaned update mechanisms from contacting compromised internet infrastructure.

Enterprise teams should run distributed queries (via Osquery or EDR platforms) to hunt for obsolete background updaters communicating with unregistered or suspicious external domains:

-- Osquery: Locate background services executing legacy update binaries
SELECT name, path, cmdline, username 
FROM processes 
WHERE (path LIKE '%update%' OR path LIKE '%updater%') 
  AND start_time < (SELECT unix_time FROM time) - 2592000;

November 2026 Patch Tuesday Preparation and Execution Plan

To navigate the upcoming deployment cycle effectively, engineering teams must combine OS-level patch management with targeted web runtime and application layer remediation protocols.

Pre-Patch Audit Matrix

System / Platform	Target Component	Validation Checklist
Web Servers (Linux/Windows)	PHP Runtime & FPM Pools	Apply PHP binary updates; stop daemon; flush memory; start daemon; audit lsof.
Application Hosts	.NET 8, 9, 10, 11 RC3	Deploy 25 October OOB patch for CVE-2026-111497; audit unmanaged brotli.dll files.
Windows Workstations/Servers	Trust List & Shell Core	Verify CTL update (7 revoked certs); stage November cumulative update for CVE-2026-96951.
Apple Endpoint Fleet	macOS & iOS Hardware	Deploy macOS Golden Gate 27; push iOS/iPadOS 18.7.11 to pre-iOS 27 mobile assets.

Vendor Release Forecast

Based on established release schedules and early vendor advisories, infrastructure teams should anticipate the following updates alongside Microsoft’s November Patch Tuesday delivery:

• Microsoft: Cumulative security updates for all supported versions of Windows Server, Windows 10, Windows 11, and core enterprise components.
• Adobe: Scheduled security updates for Adobe Acrobat and Reader, InCopy, InDesign, and Premiere Pro.
• Google: Chrome Desktop 158 stable release rollout, addressing web platform and V8 engine security vulnerabilities.
• Mozilla: Major security updates with the release of Firefox 160, Thunderbird 160, and corresponding Extended Support Releases (ESR).

Common Operational Mistakes

Avoid these operational oversights during the November maintenance window:

• Incomplete PHP Flushing: Applying PHP updates via package management without performing a full service termination and restart, leaving vulnerable code active in shared memory.
• Skipping Out-of-Band .NET Fixes: Assuming November’s cumulative update automatically remediates .NET environments without verifying whether out-of-band updates (CVE-2026-111497) were pre-requisites.
• Ignoring Disconnected CTL Stores: Relying on automated Windows Updates to push root certificate revocations in air-gapped or firewall-restricted networks.
• Overlooking End-of-Life Software: Focusing exclusively on patching active OS vendor updates while ignoring abandoned legacy software maintaining active outbound network channels.

Key Takeaways for Infrastructure and Security Leaders

The operational demands of late 2026 highlight a clear trend: traditional OS patch management must be paired with application-runtime memory management and certificate trust auditing. Securing enterprise environments requires executive focus across three core areas:

• Enforce Memory Flushing Protocols: Ensure SRE and sysadmin runbooks explicitly mandate service terminations and process restarts during runtime patching (such as PHP and .NET) to ensure stale, vulnerable dynamic libraries are purged from memory.
• Proactive PKI Governance: Audit internal and third-party dependencies on root certificates, ensuring isolated networks receive manual Certificate Trust List updates when compromised keys are revoked.
• Automated Legacy Decommissioning: Establish recurring endpoint scanning programs to hunt down and remove abandoned, end-of-life software before expired update domains can be weaponised by threat actors.

Frequently asked questions

Why does PHP2Shell patching require a full web server restart?

Updating PHP binaries on disk updates the file system, but active web server processes (like Apache or PHP-FPM workers) retain the old, vulnerable shared libraries in active system memory. A full service stop and restart terminates these worker processes, clearing stale memory blocks and forcing the web server to load the patched binaries from disk.

Which .NET runtime versions are affected by the Brotli CVE-2026-111497 flaw?

The Brotli vulnerability CVE-2026-111497 impacts .NET 8, .NET 9, .NET 10, and .NET 11 Release Candidate 3 (RC3). Microsoft addressed this issue in an out-of-band update released on 25 October 2026, which should be deployed immediately across all hosting environments.

What action is required for systems running iOS 18.7.11 or older?

Administrators managing legacy Apple mobile devices unable to upgrade to iOS 27 must immediately deploy the iOS 18.7.11 or iPadOS 18.7.11 security backport. This release fixes CVE-2026-86950, an actively exploited CoreGraphics zero-day vulnerability capable of arbitrary code execution.

How do Microsoft’s certificate trust list revocations affect local enterprise trust stores?

Connected Windows devices update their Certificate Trust Lists automatically via Windows Update. However, air-gapped systems or environments with restricted outbound network policies must manually import the updated CTL file to remove the seven compromised root and cross-signed certificates revoked on 26 October 2026.

Will preview patch fixes for Windows 11 24H2 Smart App Control be included in the November update?

Yes. The functional fix for the grayed-out Smart App Control option on Windows 11 version 24H2+, along with the fix for September’s Always On VPN connection failures, was included in late October preview patches and will roll into November’s cumulative security update.

Sources and further reading

• November 2026 Patch Tuesday forecast: Old software continues to bite – Help Net Security (Help Net Security)

This article was drafted with AI assistance from the publicly cited sources and passed automated checks for structure and sourcing. Verify critical details against the vendor advisories linked above before acting.