Patch volumes keep breaking records. Microsoft’s October 2026 Patch Tuesday alone addressed around 1,400 CVEs. With that much noise, the real skill is knowing what to patch first. This security patch roundup collects the most important fixes for IT teams this month, plus a simple way to prioritise.

Priority Overview

Priority	Issue	Why
Critical	PHP2Shell (CVE-2026-109618 / 109619)	Unauthenticated RCE, CVSS 9.2, in CISA KEV
Critical	Windows Shell zero-day (CVE-2026-96951)	Exploited in the wild, fixed in October Patch Tuesday
High	Microsoft Paint RCE (CVE-2026-83844)	CVSS 8.1, fixed via Microsoft Store update
High	Brotli library flaw	Affects .NET and Node.js apps that decompress data
High	Android November bulletin	200+ fixes incl. CVE-2026-58868
Medium/High	BIND IXFR bypass (CVE-2026-19033)	DNS servers using zone transfers

1. PHP2Shell – Patch Immediately

Two critical unauthenticated RCE flaws in PHP’s request handling. Fixed in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Both CVEs are in CISA’s Known Exploited Vulnerabilities catalog. Read our full PHP2Shell check and patch guide.

2. Windows Shell Zero-Day (CVE-2026-96951)

Fixed in October’s Patch Tuesday and exploited in the wild. If any endpoints missed October updates, prioritise them now. Verify with PowerShell:

# List the most recently installed updates
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10

3. Microsoft Paint RCE (CVE-2026-83844)

Yes, Paint. This CVSS 8.1 remote code execution bug is fixed through the Microsoft Store in Paint build 11.2609.401.0 or later. Because it’s a Store app, it may not be covered by your normal WSUS patching – check that Store updates are allowed or deploy via Intune/winget.

winget upgrade --id 9PCFS5B6T72H --source msstore
Get-AppxPackage Microsoft.Paint | Select-Object Name, Version

4. Brotli Compression Library Flaw (.NET and Node.js)

A vulnerability in the widely used Brotli compression library led Microsoft to ship .NET patches, and Node.js is also affected. Any app that decompresses untrusted Brotli data – such as HTTP clients and servers – should be updated.

dotnet --list-runtimes     # update to the latest patched runtime
node -v                    # upgrade to the latest patched LTS release

5. Android November Security Bulletin

Google’s November Android updates include 200+ fixes, including CVE-2026-58868. Use your MDM to enforce a minimum security patch level on managed devices.

6. BIND IXFR Bypass (CVE-2026-19033)

ISC BIND DNS servers that use incremental zone transfers (IXFR) should be updated to the latest patched release.

named -v
sudo apt update && sudo apt install --only-upgrade bind9

Also Worth Knowing

• Weak CA keys: certificate authority eMudhra’s keys were reportedly cracked because they were poorly generated – a reminder to monitor Certificate Transparency logs for your domains.
• AI-tool supply chain: an attack on the OpenCode agent tool stole some users’ API keys. Rotate keys used by AI coding tools.
• Microsoft Ignite runs November 17–20 – expect more security announcements.

How to Prioritise Patches

1. Known exploited first – anything in CISA KEV or confirmed exploited.
2. Internet-facing systems next – web servers, VPNs, DNS, email gateways.
3. Unauthenticated RCE beats authenticated or local bugs.
4. Then by CVSS and asset value – crown-jewel systems first.
5. Don’t forget “non-standard” channels – Store apps, containers, language runtimes, firmware.

Conclusion

This month’s security patch roundup shows how wide the attack surface has become – from PHP and DNS to Paint and compression libraries. Patch known-exploited and internet-facing issues first, automate the rest, and verify that every update channel in your environment is actually covered.