---
title: Microsoft's consolidated "patch now" guidance for PHP2Shell, Brotli and eMudhra; Visual Studio gets Oct 30 fixes, including CVE-2026-118147 for the eMudhra certificates | ctxsec
url: https://ctxsec.com/items/msrc-patch-now-php2shell-brotli-emudhra-visual-studio-cve-2026-118147
description: ""
status: "official (MSRC blog and Security Update Guide, Oct 30); PHP2Shell and Brotli are on CISA KEV"
published: 2026-10-30
---

> 

[← Cybersecurity News](/news) · [markdown](/items/msrc-patch-now-php2shell-brotli-emudhra-visual-studio-cve-2026-118147.md)

official (MSRC blog and Security Update Guide, Oct 30); PHP2Shell and Brotli are on CISA KEV

2026-10-30

### Microsoft's consolidated "patch now" guidance for PHP2Shell, Brotli and eMudhra; Visual Studio gets Oct 30 fixes, including CVE-2026-118147 for the eMudhra certificates

MSRC published one guide covering the three third-party issues that have driven out-of-band work this month, saying who patches what across Microsoft services, Azure resources and software customers install themselves. New on **Oct 30**: **Visual Studio** fixes for both the Brotli flaw and the eMudhra trust problem.

- **CVE-2026-118147** (Visual Studio spoofing, Important, CVSS 7.4, not exploited): fixes trust in the compromised eMudhra emSign G3 certificates in Visual Studio 2017 15.9, 2019 16.11, 2022 17.14 and 2026 18.11.
- **Brotli CVE-2026-111497** (on KEV): Visual Studio fixes released Oct 30; also update .NET to 8.0.33, 9.0.22 or 10.0.14, PowerShell 7 (7.6.9, 7.5.13 or 7.4.22), Node.js (22.23.4, 24.22.1 or 26.12.1), Git for Windows 2.56.0.windows.4 or later, Python brotli/brotlicffi 1.2.1, and PHP Windows builds `-1` (the PHP version number does not change, so check the build number).
- **PHP2Shell CVE-2026-109618/109619** (on KEV): Windows Update does not patch PHP you installed on Windows; update to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 and recycle IIS app pools or FastCGI.
- **Gotchas:** self-contained and Native AOT .NET apps must be rebuilt with the latest SDK; containers and custom images must be rebuilt; the eMudhra and Brotli out-of-band updates need an extra restart; Azure WAF only inspects inbound requests, so apps that fetch Brotli-compressed responses still need patching; Brotli can also come in transitively (DuckDB, Apache Arrow, p7zip, woff2).

**Do now:** run Visual Studio Installer updates on developer machines and build agents, and check self-contained .NET apps and container images you ship.

Sources: [MSRC: Patch now: PHP2Shell, Brotli, and eMudhra guidance for customers (Oct 30)](https://www.microsoft.com/en-us/msrc/blog/2026/10/patch-now-php2shell-brotli-emudhra-guidance-for-customers) · [Microsoft Security Update Guide: CVE-2026-118147 Visual Studio Spoofing Vulnerability](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118147) · [Microsoft Security Update Guide: CVE-2026-111497](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-111497)