Microsoft MSRC guidance published October 30, 2026
Microsoft Tells Customers to Patch Now: PHP2Shell, Brotli and the eMudhra Trust Removal All Need Action Outside Patch Tuesday
Microsoft published consolidated guidance on October 30 for three issues disclosed within days of each other in October, none of which began as a flaw in Microsoft own code, and all of which require customer action beyond the normal monthly cycle. PHP2Shell, the pair of critical PHP remote code execution flaws CVE-2026-109618 and CVE-2026-109619 disclosed October 21, and the Brotli decoder flaw CVE-2026-111497, an out-of-bounds write in the Google compression library built into .NET, Node.js, PowerShell 7, Visual Studio, and PHP, are both in the CISA KEV catalog, added October 26 and October 27 respectively, and Microsoft instructs customers to treat them as urgent. Fixed PHP versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12, followed by a restart of the PHP process or web server; fixed Brotli arrives by updating each product that bundles it, including .NET 8.0.33, 9.0.22, and 10.0.14 and Node.js 22.23.4, 24.22.1, and 26.12.1. The third issue is a trust failure rather than a code flaw: eight eMudhra emSign G3 intermediate certificate authority keys were generated weakly enough to be recovered, so certificates chaining to them should no longer be trusted. Microsoft blocked the authorities on October 20, removed roots through the October 26 out-of-band Windows update, and on October 30 released the Visual Studio fix under CVE-2026-118147, covering Visual Studio 2017 version 15.9, 2019 version 16.11, 2022 version 17.14, and 2026 version 18.11. Microsoft divides the work explicitly: services it operates are patched on its emergency path, automatically patched resources install fixes in their maintenance windows with a restart that should not be postponed, and anything customers patch manually, install themselves, or bundle into containers and self-contained applications is theirs to rebuild and redeploy, including application trust stores such as Java keystores and Python certificate bundles that operating system updates do not touch. The post notes exploitation attempts were reported before coordinated disclosure and proof-of-concept code appeared within hours of the PHP fixes.
Executives
Three separate October issues converge on one operational fact: the fixes exist, and the remaining exposure is mostly waiting, waiting for a maintenance window, a restart, or a rebuild that nobody scheduled. Microsoft guidance is unusually direct that postponing the restart postpones the protection. Leadership attention belongs on the inventory of systems your teams patch and bundle themselves, because those are precisely the ones no vendor emergency path reaches.
CIO / CISO
Work the vendor split as your checklist: confirm the Microsoft-operated services need nothing from you, pull forward maintenance windows for internet-facing automatically patched resources instead of letting the restart wait, and enumerate the self-managed layer in writing, PHP installations, Node.js and .NET runtimes, PowerShell 7, Visual Studio, Git for Windows, container images, and self-contained .NET applications that must be rebuilt with a patched SDK rather than updated on the host. Add trust stores to the same list: Java keystores, Python bundles, and framework stores keep trusting the removed eMudhra roots until someone updates them directly. The Visual Studio fixed builds for CVE-2026-118147 are 15.9.84, 16.11.62, 17.14.44, and 18.11.3 by product line.
Engineers
Patch and restart as one task: a PHP package update without a PHP-FPM or web server restart leaves the vulnerable runtime loaded, and a kernel-style mistake in miniature. For Brotli, update the carrying product, not a standalone library you may not have, and rebuild container and custom images rather than patching running instances. For eMudhra, search beyond the operating system store for the affected intermediates in every application store you ship, and replace any certificate that chains to the removed roots. Disconnected Windows machines need the October 26 out-of-band update installed manually, since they cannot reach the automatic trust update service.
Everyone (non-IT)
Expect restarts and brief service interruptions in the coming days even though Patch Tuesday has passed. These fixes close flaws that are already being exploited and remove trust from compromised certificate authorities, so a restart notice from your IT team this week is the protection arriving, not a problem with your machine.