The week in review: Secure Boot, PHP2Shell, Exchange and everything else that happened

It's been one of the toughest weeks for IT and security teams in a long time. If you spent it firefighting and lost track, here's everything that happened, in order, with what it means for you.

Monday: the last 2011 Secure Boot certificate expired

The Microsoft Windows Production PCA 2011 certificate, which signs the Windows boot manager, expired on Monday 19 October. It was the last of the 2011 Secure Boot certificates. The others expired in June.

Nothing stopped working. Microsoft says devices without the 2023 certificates still start and run normally. What they lose is future protection for the boot process: no new boot manager fixes, no new Secure Boot database or revocation updates, and no fixes for boot-chain flaws found from now on. Microsoft also warns against turning Secure Boot off as a workaround.

What to do: find the devices still on the 2011 certificates and get them updated. The checks and an Intune report are in last week's Secure Boot post.

Tuesday to Thursday: PHP2Shell

The biggest story of the week.

• Tuesday evening: the PHP team warned that a fix for two critical flaws would ship the next day.
• Wednesday: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released. Both flaws, CVE-2026-109618 and CVE-2026-109619, are rated 9.2 and can allow remote code execution without signing in. Governments, ports, hospitals and universities across Europe took websites offline rather than wait. CISA issued an alert saying the flaws require immediate patching.
• The AI angle: Wiz found the flaws with its own AI tool alongside Gemini and GPT models. They had been in PHP for more than a decade.
• Thursday: watchTowr reported attackers trying to exploit both flaws, and more security firms have since reported live exploitation.

What to do: if anything still runs an unpatched PHP version, treat it as urgent. For anything that was internet-facing and unpatched for a few days, check for signs of compromise, not just the version number. The Azure steps are in the PHP post.

All week: October's Windows updates bit back

• Exchange Server: on Windows Server 2019 and later, some busy on-premises Exchange servers stopped letting users sign in to Outlook on the web and left mail stuck in Outboxes. The cause is a new limit on Endpoint Mapper lookups. Microsoft says not to uninstall the update, and has a registry workaround.
• Always On VPN: Microsoft said October's update fixed connections getting stuck when falling back between IKEv2 and SSTP, then reversed that. Until the real fix ships, set profiles to a single protocol.
• Smart App Control: on Windows 11 24H2 and later, some devices can't turn it back on once it's off. Devices that already have it on are fine.
• NTLMv1 hardening: a planned change, now on by default. Wi-Fi and VPN connections that use MS-CHAPv2 can fail single sign-on on devices without Credential Guard.

All four, with the fix for each, are in Thursday's roundup.

On this site

Ten new free tools went live this week, including an NSG rule tester, an Azure Policy tester, a dynamic group rule tester and a Conditional Access coverage matrix. Admin Lens 2.1 now explains RBAC actions, IP addresses, Windows builds, certificates and sign-in logs. Here's everything that's new.

Five things to check before Monday

1. PHP: every internet-facing PHP app is on 8.5.12, 8.4.27, 8.3.36 or 8.2.35, or offline.
2. Compromise checks: anything that was exposed and unpatched for a while has been looked at for new files, odd processes and unexpected restarts.
3. Secure Boot: you know how many devices are still on the 2011 certificates, and there's a plan for them.
4. Exchange: busy on-premises servers have the Endpoint Mapper workaround, and the October update is still installed.
5. Wi-Fi and VPN: you know which profiles still use MS-CHAPv2, and the move to certificates is on someone's list.

Have a good weekend. Let's hope next week is quieter.

Sources

• Windows Secure Boot certificate expiration and CA updates and When Secure Boot certificates expire on Windows devices (Microsoft)
• php.announce (PHP team)
• Critical Vulnerabilities in PHP Require Immediate Patching (CISA)
• PHP2Shell (Wiz Research) and exploitation update (watchTowr)
• Exchange servers may become unstable after October 2026 Windows updates (Microsoft Exchange Team)
• Windows message center (Microsoft)