November 2026 Patch Tuesday
What's happened since October Patch Tuesday The weeks leading up to November Patch Tuesday gave defenders three clear tests of how fast they can move. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) was exploited before PHP shipped fixes and reached CISA’s Known Exploited Vulnerabilities (KEV) catalog on October 26. Node2Shell (CVE-2026-111497) followed on October 27. Then SSHole (CVE-2026-123158), an OpenSSH authentication bypass that affects only specific configurations, was exploited within days of disclosure and added to KEV on November 9. Each had a different exposure profile, and the response had to start with the same question: are we running it, is it reachable, and is anyone exploit
Read at Ivanti security advisories (blog)
- Vendor
- Ivanti, PHP
- Product
- PHP
- CVSS
- 6.5
- EPSS
- 0.17 (p97)
- Exploitation
- observed in the wild
- Fix
- available
- Exposure class
- Web platform
Why it ranks 85 (Critical)
- Exploitation observed in the wild
- CVSS 6.5 medium
- EPSS 0.17 (elevated)
- Product class: web platform
- Widely deployed vendor product (Ivanti)
- Covered by 40 independent sources
- Fix available
- Vendor security advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- Ivanti security advisories (blog) (ivanti.com)
- CVE-2026-109618 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-109619 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-111497 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-123158 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-124194 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.