Cut-paper illustration of a server rack covered by three overlapping paper patches, a clipboard checklist with a magnifying glass, and small paper shapes for a browser window, a compression coil, and a certificate seal

On October 30, Microsoft published one piece of guidance covering three problems disclosed within days of each other: two critical PHP flaws, a flaw in the Brotli compression library, and a certificate authority key compromise. None started as a flaw in a Microsoft product. All land on the same person: the admin who must find every copy of the affected code and every place that trusts the affected certificates.

That is the point. None is hard to patch once you know where it lives. The work is the inventory. PHP hides inside other software. Brotli hides inside runtimes and tools. A trust store hides inside an application that never touches the operating system certificate store. CISA added the PHP flaws to its exploited list on October 26, and Brotli on October 27.

Three problems, one inventory

Problem What is broken The fix is
PHP2Shell, CVE-2026-109618 and CVE-2026-109619 The PHP runtime that serves web requests A newer PHP runtime, then a restart
Brotli, CVE-2026-111497 A compression library bundled into runtimes and tools A newer version of the product that carries it, then a restart or rebuild
eMudhra, emSign G3 Eight intermediate CA keys generated weakly enough to be recovered Stop trusting the affected certificates everywhere, and replace certificates chaining to the removed roots

PHP: patch the runtime, then restart it

PHP2Shell is two flaws in PHP core, both rated 9.2 by the PHP project, both allowing unauthenticated remote code execution. They affect every PHP installation serving web requests, including Apache with mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed. PHP calls mod_php the highest risk, because the exploit can fire before any application code runs. The flaw is in the runtime, not the framework on top.

The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35, shipped October 21. Use the release for your branch, or your distribution's fixed package. Then restart PHP-FPM or the web server so the fixed runtime loads.

Two details matter. PHP 8.1 and earlier get no fix. CISA says systems that cannot be updated right away, or still run PHP 8.1 or earlier, should be taken offline until patched or updated. A web application firewall may help meanwhile, but CISA presents it as a stopgap, not a fix. Windows does not include PHP, so Windows Update cannot patch PHP you installed yourself. Get a fixed build from php.net, recycle the IIS pools or FastCGI processes, and rebuild any container image that includes PHP.

CISA warns PHP often arrives as a component of other software, and its presence may not be directly observable. Ask where PHP runs here, including places nobody thinks of as a PHP server.

Brotli: patch the product, not the library

The Brotli flaw is an out of bounds write in Google's Brotli decoder. A crafted compressed stream can corrupt process memory, disclose memory, crash the process, or potentially allow remote code execution. Google assigned it a CVSS 4.0 score of 9.2. Affected Brotli versions are 1.0.3 through 1.2.0, fixed in 1.0.10, 1.1.1, and 1.2.1.

You will almost never patch Brotli by itself. You patch the product carrying it: Node.js, .NET, PowerShell 7, Visual Studio, PHP's Windows builds, Git for Windows, Python packages, and more. Microsoft lists the versions to look for: Node.js 22.23.4, 24.22.1, or 26.12.1; .NET 8.0.33, 9.0.22, or 10.0.14; PowerShell 7 at 7.6.9, 7.5.13, or 7.4.22; Git for Windows 2.56.0.windows.4 or later; Python brotli 1.2.1 and brotlicffi 1.2.1.0. On Linux, install your distribution's updated Brotli and runtime packages.

Three traps are worth naming. A self contained .NET application bundles its own runtime, so updating the host runtime does not fix it. Install the latest patched .NET SDK, rebuild, and republish. The same applies to containers: rebuild on the latest base image and redeploy. Windows Update does not deliver the .NET or PowerShell 7 updates unless you opted in to receive updates for other Microsoft products through Microsoft Update. For PHP on Windows, the Brotli fix is in the rebuilt builds 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1. The version number does not change, so check the build number.

Scope narrows the search. In .NET, the first two Brotli paths are off by default. In PowerShell 7, automatic decompression is on by default for Invoke-WebRequest and Invoke-RestMethod. The legacy .NET Framework in Windows is not affected.

eMudhra: trust is the patch

This one is not a software flaw. Eight eMudhra emSign G3 intermediate keys, six for TLS and two for code signing, were generated weakly enough to be recovered. A holder could issue a trusted certificate, impersonate a website, intercept traffic, or make malicious software look publisher trusted. There is no binary to update.

Microsoft blocked the affected authorities through the Windows Disallowed Certificate Trust List on October 20, and removed seven certificates from the Windows trust list in an out of band update on October 26. A CRLSet update for Edge and WebView2 blocks the affected TLS certificates. That covers machines receiving those updates. Disconnected Windows machines need the out of band update installed directly, or a redeploy from an updated image. Linux needs the distribution's updated certificate packages, including inside Windows Subsystem for Linux.

Then check the stores outside the operating system. Java keystores, Python certificate bundles, and container images do not change when the operating system updates its store. Search them, replace certificates chaining to the removed roots, and make sure a later rebuild does not reintroduce trust in the affected hierarchy. These out of band fixes also need an additional restart. Plan for it.

Run it as one pass

Work all three together.

  1. List every PHP install, Node.js and .NET runtime, PowerShell 7 install, and container image bundling any of them, including copies inside applications.
  2. Start with internet facing systems. Patch PHP, patch the Brotli carriers, install the trust updates, then restart or rebuild and verify the new version is running.
  3. Search trust stores outside the operating system, in Java, Python, and container images, and replace certificates chaining to a removed root.
  4. Check the paths that silently do nothing: the Microsoft Update opt in, the PHP Windows -1 build, and rebuilds for self contained apps and containers.
  5. Set maintenance windows to absorb out of band fixes. Turn on automatic patching where you can, make restart routine, and keep an inventory of open source components.

A week with three unrelated disclosures tests whether you know what you run. The patches exist. The question is whether your list is complete enough to use them.

Sources