Help Net Security reports PHP2Shell exploitation in November forecast

What happened

A Patch Tuesday forecast column published by Help Net Security reports several items from October 2026 that it says still need attention. The column was written by Todd Schell, a senior product manager at Ivanti. These are the column’s statements. The PHP advisory and the vendor advisories it refers to were not among the sources reviewed here.

PHP2Shell. Help Net Security reports that researchers call CVE-2026-109618 and CVE-2026-109619 “PHP2Shell”. The column says PHP published a security advisory on October 21 listing the fixed PHP versions. It also says exploitation in the wild was detected several days before the patches were released and “is continuing to expand”. According to the column, exploitation gives an attacker access to whatever the PHP shell can see. The specific fixed version numbers are not confirmed in the source.

Microsoft, October. The column says Microsoft fixed 1,407 unique CVEs in October 2026. It reports that CVE-2026-96951, a Windows Shell security feature bypass affecting Windows 10, Windows 11 and Windows Server, was confirmed exploited. It also reports that CVE-2026-10839, a .NET Framework security bypass, was publicly disclosed.

Brotli emergency fix. According to the column, Microsoft released an out-of-band fix on October 25 for CVE-2026-111497. This flaw is also called Broccoli2Shell, Node2Shell or HTTP2Shell, and the column says it lies in the Brotli binaries or libraries that process Brotli-compressed data. The fixes cover .NET 8, 9 and 10 and Release Candidate 3 of .NET 11. The column says proof-of-concept code exists but there is no known exploitation in the wild.

Certificates. The column says Microsoft removed seven certificates from the Windows trust list on October 26 because their keys had been compromised: six eMudhra G3 roots and an AAA Certificate Services cross-sign.

Apple. Help Net Security reports that Apple shipped security updates for its supported operating systems on October 26. It also backported a fix to iOS 18.7.11 and iPadOS 18.7.11 for CVE-2026-86950, a CoreGraphics flaw that could lead to arbitrary code execution. The column quotes Apple as saying the issue “may have been exploited in an extremely sophisticated attack against specific targeted individuals”.

Obsolete software. The column cites an article about an abandoned 2014 application that was still running on 2.5 million Windows devices and 300,000 Macs. Some of the domains it contacted for updates were open for registration. The column says the problem was found and the software removed before anyone abused it.

Am I affected?

• PHP: If you run PHP on any server, you may be affected by CVE-2026-109618 and CVE-2026-109619, according to the column. Which PHP versions are affected and which are fixed is not confirmed in the source.
• Windows: Windows 10, Windows 11 and Windows Server systems without the October 2026 updates are exposed to CVE-2026-96951, per the column.
• .NET: Applications on .NET 8, 9, 10 or .NET 11 RC3 that use the Brotli libraries need the October 25 fix, per the column.
• iOS and iPadOS: Devices on older iOS or iPadOS versions should move to 18.7.11, per the column.

What to do now

1. Patch PHP. Find the fixed PHP versions in PHP’s October 21 advisory or in your OS vendor’s packages. Then replace the PHP runtime and stop and restart the web server. Help Net Security notes that without a restart, the old code stays in memory.
2. Check PHP hosts for compromise. The column reports exploitation before patches were available, so review PHP hosts for signs of compromise. Assess what data and systems the PHP process could reach.
3. Apply October fixes now. Install the October 2026 Microsoft updates and the October 25 .NET Brotli fix. The column says all of these fixes will also be included in the November Patch Tuesday cumulative release.
4. Update Apple devices. Update Apple devices, including older iPhones and iPads, to 18.7.11 or later.
5. Remove unused software. Inventory and remove end-of-life and abandoned software, especially software with network connectivity.

Sources

• Help Net Security: November 2026 Patch Tuesday forecast: Old software continues to bite