Active Exploits and Emergency Fixes Pressure Teams Ahead of Patch Tuesday

IT and security teams are working through a wave of critical updates and active attacks ahead of the upcoming November Patch Tuesday cycle. According to reporting from Help Net Security, system administrators must address expanding in-the-wild exploitation of server-side vulnerabilities alongside multiple out-of-band updates issued across both Microsoft and Apple ecosystems in late October.

PHP2Shell Under Active Exploitation

The most pressing immediate threat involves two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell by security researchers. PHP serves as server-side middleware handling requests between web servers and client browsers. Exploitation grants malicious actors full access to anything visible to the PHP shell environment.

The PHP project issued an advisory and corresponding software updates on October 21. However, security researchers detected in-the-wild exploitation several days prior to the release of the official fixes, and attacks have continued to spread. Defending against PHP2Shell requires more than just installing new packages; administrators must replace the runtime, halt the web server service, and complete a full restart. If the server is not restarted, the vulnerable code remains resident in system memory, leaving systems exposed.

Emergency Patches and Certificate Revocations

Microsoft followed its October update cycle with critical out-of-band updates. On October 25, the vendor issued an emergency security fix for CVE-2026-111497, also referred to as Broccoli2Shell, Node2Shell, or HTTP2Shell. The vulnerability originates in Brotli binaries and libraries used for processing compressed data and impacts .NET versions 8, 9, and 10, as well as Release Candidate 3 for .NET 11. While proof-of-concept exploit code is publicly available, no in-the-wild exploitation has been observed to date.

On October 26, Microsoft took action against compromised digital trust assets by removing seven certificates from the Windows trust list. The revoked credentials consisted of six eMudhra G3 root certificates and an AAA Certificate Services cross-signed certificate following confirmation of compromised cryptographic keys.

The upcoming November cumulative updates will also integrate fixes for operational bugs introduced in recent months. Previous updates broke Always On VPN connectivity starting in September, while the October Windows update caused Smart App Control to gray out on Windows 11 version 24H2 and newer systems.

Apple Addresses Targeted Mobile Attacks

Apple delivered a broad collection of security updates on October 26, addressing 183 CVEs in macOS Golden Gate 27 alone. Notably, the vendor also backported security fixes to legacy mobile operating systems by releasing iOS 18.7.11 and iPadOS 18.7.11.

These backported releases resolve CVE-2026-86950, a flaw located in the CoreGraphics framework that allows arbitrary code execution. Apple confirmed awareness of reports indicating the vulnerability was exploited in sophisticated attacks directed at specific targeted individuals on devices running versions prior to iOS 27.

Risks from Obsolete and Abandoned Software

Beyond current software updates, security audits continue to highlight the dangers of unmonitored legacy software. An investigation cited by Help Net Security revealed an abandoned application dating back to 2014 that remained active on 2.5 million Windows computers and 300,000 Mac devices. The software routinely reached out to external domains for updates.

Investigators discovered that several update domains used by the software had expired and were available for public registration. Had an attacker acquired those domain names, they could have pushed malicious update packages to compromise nearly three million devices. While the software was uninstalled before any tampering occurred, the incident underscores the threat posed by forgotten services maintaining network connections.

What You Should Do

Security teams should take immediate steps to insulate their environments before the November update wave arrives:

• Prioritize PHP updates and service restarts: Deploy patched PHP runtimes to resolve CVE-2026-109618 and CVE-2026-109619. Ensure that associated web server services are fully restarted to clear unpatched code from memory.
• Patch .NET implementations: Apply the emergency update for CVE-2026-111497 across environments running .NET 8, 9, 10, or .NET 11 RC3.
• Update legacy Apple hardware: Ensure any iPhones or iPads running older operating system branches receive iOS 18.7.11 or iPadOS 18.7.11 to neutralize active exploits targeting CVE-2026-86950.
• Audit and purge end-of-life software: Scan endpoints and servers for obsolete network-facing applications that no longer receive vendor support, preventing supply-chain takeover via expired update infrastructure.