November 2026 Patch Tuesday forecast: Old software continues to bite
Our summary
Following a record October that fixed 1,407 CVEs, security teams are bracing for another heavy Patch Tuesday from Microsoft in November, alongside expected updates from Adobe, Google Chrome, and Mozilla Firefox/Thunderbird. Much of the recent attention has centered on PHP, where two actively exploited flaws, CVE-2026-109618 and CVE-2026-109619 (dubbed PHP2Shell), let attackers gain shell-level access through the PHP runtime and require a full service restart to fully remediate. Microsoft also pushed out-of-band fixes outside the normal cycle, including an emergency patch for CVE-2026-111497 (Broccoli2Shell/Node2Shell/HTTP2Shell) affecting Brotli compression libraries in .NET 8, 9, 10 and the .NET 11 release candidate, plus removal of seven compromised trust-list certificates. Apple separately patched a known-exploited CoreGraphics bug, CVE-2026-86950, via backport to iOS/iPadOS 18.7.11, used in targeted spyware-style attacks, underscoring why organizations must also keep hunting for and retiring end-of-life software that quietly keeps running and phoning home long after support ends.
Help Net Security publishes this story on its own site; we link to it rather than reprint it.
Worried this affects your company?
Discuss a security assessment of your internet-facing systems. Scope agreed before testing.