November 2026 Patch Tuesday forecast: PHP2Shell exploited in the wild, Brotli flaw patched out-of-band, exploited Apple CoreGraphics flaw
This Help Net Security forecast recaps October 2026 and previews November Patch Tuesday. In October, Microsoft fixed a record 1,407 unique CVEs, including 78 Critical. One zero-day, CVE-2026-96951 (Windows Shell security feature bypass), was exploited, and the .NET Framework bypass CVE-2026-10839 was publicly disclosed. The most urgent item is PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP published an advisory on October 21, and the article says exploitation began several days before the patches and is still growing. Microsoft also shipped an out-of-band fix on October 25 for CVE-2026-111497, the Brotli flaw (Broccoli2Shell, Node2Shell or HTTP2Shell). The fixes address the Brotli libraries in .NET 8, 9, 10 and Release Candidate 3 of .NET 11. Proof-of-concept code exists, but the article reports no known exploitation. This report rests on the article alone, with no vendor advisory checked.
Entenda a falha
A vulnerabilidade
The story covers several flaws, and the only source is a Help Net Security forecast with few technical details. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) in PHP is the most urgent: it is exploited in the wild and gives the attacker access to whatever the PHP shell can see. CVE-2026-86950 is an Apple CoreGraphics flaw that can lead to arbitrary code execution; Apple says it may have been used in an extremely sophisticated attack on targeted people on iOS before 27, and the fix was backported to iOS and iPadOS 18.7.11. CVE-2026-111497 (Broccoli2Shell, Node2Shell or HTTP2Shell) is a flaw in the Brotli libraries in .NET 8, 9, 10 and .NET 11 RC3, fixed out-of-band on October 25. CVE-2026-96951 is a Windows Shell security feature bypass exploited as a zero-day on Windows 10, 11 and Server. CVE-2026-10839 is a publicly disclosed .NET Framework bypass. The article does not give the attacker's prerequisites or the fixed PHP versions.
Como funciona
The article describes the mechanism only for the Brotli flaw: the affected libraries process Brotli-compressed data, and the flaw sits in that handling, which is where the names Node2Shell and HTTP2Shell come from. For PHP2Shell, PHP runs on a server between the web server and the requesting browser, and a successful attack ends with access to what the PHP shell can see. The article does not say which input triggers the flaws or at which step they fail. It does note that after the PHP runtime is replaced, the web server must be restarted, because otherwise the old code stays in memory.
Por que é vulnerável
The article does not state the root cause of any of these flaws. For Brotli it only says the problem is in the libraries or binaries that process Brotli-compressed data, and the out-of-band fix replaces those libraries in .NET 8, 9, 10 and .NET 11 RC3. For PHP, the fix means replacing the runtime, and a restart is needed so the patched code is actually loaded.
Como foi descoberta
PHP published a security advisory on October 21 for PHP2Shell, the name researchers use for it. The article says exploitation in the wild began several days before the patches and is still growing. Microsoft shipped the Brotli fix out-of-band on October 25, and the article does not say who found it. Apple's backport came in its October 26 updates, and Apple attributes the flaw to a report of possible exploitation in a targeted attack. CVE-2026-96951 was confirmed exploited at the time of the October Patch Tuesday, and CVE-2026-10839 was publicly disclosed. The article does not say how any of them were first found.
PoC pública
The article says proof-of-concept code is available for the Brotli flaw (CVE-2026-111497), with no known exploitation in the wild at this time. It does not say who published it, what it demonstrates or how mature it is, and it gives no address. Since a PoC exists, patching the .NET Brotli libraries should not wait, even without observed attacks.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 09:54.
Exploit público
Há código de exploração publicado no Exploit-DB para CVE-2026-109618. O código não é reproduzido aqui: o link leva à fonte, e a explicação foi escrita pela IA a partir do arquivo publicado.
-
PHP2Shell (CVE-2026-109618) - PHP core versions after v5.4 - RCE
This script attacks PHP running under Apache mod_php (prefork) by sending crafted multipart uploads to any PHP page, abusing session upload-progress handling to corrupt memory. It needs only network access and no login, but the target must have specific settings: upload progress enabled, non-strict sessions, a low memory limit and a single worker. It leaks memory addresses via session cookies, then makes PHP run a short system command (14 bytes max). It looks like a working but fragile exploit, tuned to PHP 8.4.26 builds; the claim of all versions after 5.4 is unproven.
Detalhes técnicos
- PHP2Shell: successful exploitation gives the attacker access to whatever the PHP shell can see.
- CVE-2026-111497: a flaw in the Brotli libraries that process Brotli-compressed data.
- Apple: updates on October 26 included a backport to iOS and iPadOS 18.7.11 for CVE-2026-86950, a CoreGraphics flaw that can lead to arbitrary code execution. Apple said it may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
- Microsoft trust list: on October 26, Microsoft removed seven certificates from the Windows trust list (six eMudhra G3 roots and an AAA Certificate Services cross-sign) because their keys had been compromised.
- Abandoned software: the article cites an abandoned 2014 application that was still running on 2.5 million Windows devices and 300,000 Macs. It tried to self-update from domains that were open for registration, so an attacker could have pushed a malicious update. The software was removed before that happened.
- Microsoft fixes: preview patches fixed Always On VPN failures introduced in the September updates, and a Smart App Control problem caused by the October update on Windows 11 24H2 and later.
Remediação
- PHP: replace the PHP runtime, then stop and restart the web server. Without a restart, the old code stays in memory. Assess systems for compromise.
- .NET: apply the fixes for the Brotli libraries in .NET 8, 9, 10 and .NET 11 RC3 as soon as possible.
- Apple: apply iOS and iPadOS 18.7.11 on older devices.
- Software inventory: find and remove EOL or obsolete software.
- Forecast for November: expect updates from Microsoft, Adobe, Google Chrome 158 and Mozilla Firefox and Thunderbird 160. Apple is not expected to release anything.
Linha do tempo
-
November 2026 Patch Tuesday forecast: PHP2Shell exploited in the wild, Brotli flaw patched out-of-band, exploited Apple CoreGraphics flaw
ler a análise desta fonte ocultar
This Help Net Security forecast recaps October 2026 and previews November Patch Tuesday. In October, Microsoft fixed a record 1,407 unique CVEs, including 78 Critical. One zero-day, CVE-2026-96951 (Windows Shell security feature bypass), was exploited, and the .NET Framework bypass CVE-2026-10839 was publicly disclosed. The most urgent item is PHP2Shell (CVE-2026-109618 and CVE-2026-109619). PHP published an advisory on October 21, and the article says exploitation began several days before the patches and is still growing. Microsoft also shipped an out-of-band fix on October 25 for CVE-2026-111497, the Brotli flaw (Broccoli2Shell, Node2Shell or HTTP2Shell). The fixes address the Brotli libraries in .NET 8, 9, 10 and Release Candidate 3 of .NET 11. Proof-of-concept code exists, but the article reports no known exploitation. This report rests on the article alone, with no vendor advisory checked.
Technical Details
- PHP2Shell: successful exploitation gives the attacker access to whatever the PHP shell can see.
- CVE-2026-111497: a flaw in the Brotli libraries that process Brotli-compressed data.
- Apple: updates on October 26 included a backport to iOS and iPadOS 18.7.11 for CVE-2026-86950, a CoreGraphics flaw that can lead to arbitrary code execution. Apple said it may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27.
- Microsoft trust list: on October 26, Microsoft removed seven certificates from the Windows trust list (six eMudhra G3 roots and an AAA Certificate Services cross-sign) because their keys had been compromised.
- Abandoned software: the article cites an abandoned 2014 application that was still running on 2.5 million Windows devices and 300,000 Macs. It tried to self-update from domains that were open for registration, so an attacker could have pushed a malicious update. The software was removed before that happened.
- Microsoft fixes: preview patches fixed Always On VPN failures introduced in the September updates, and a Smart App Control problem caused by the October update on Windows 11 24H2 and later.
Remediation
- PHP: replace the PHP runtime, then stop and restart the web server. Without a restart, the old code stays in memory. Assess systems for compromise.
- .NET: apply the fixes for the Brotli libraries in .NET 8, 9, 10 and .NET 11 RC3 as soon as possible.
- Apple: apply iOS and iPadOS 18.7.11 on older devices.
- Software inventory: find and remove EOL or obsolete software.
- Forecast for November: expect updates from Microsoft, Adobe, Google Chrome 158 and Mozilla Firefox and Thunderbird 160. Apple is not expected to release anything.