This week's three items sit below the apps people see. One is a compression library inside web servers and business apps that attackers are now exploiting. One is server firmware that runs before Windows starts. One is the list of certificates Windows trusts.
None of them needs a big project for a Milwaukee or Southeast Wisconsin office, but each needs someone to check something specific: a runtime version, a BIOS setting, or whether a few locked-down PCs still get certificate updates.
Brotli flaw is now exploited, and .NET got an emergency update
What happened
Brotli is a compression format used by web servers, browsers, and apps that move data over HTTP. A bug in its decoder, CVE-2026-111497, lets a crafted Brotli stream corrupt memory. CISA describes it as a flaw that lets "a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code." On October 27, CISA added it to the Known Exploited Vulnerabilities catalog "based on evidence of active exploitation." (CISA)
The fix first shipped in Node.js on October 21 (Node.js 22.23.4, 24.22.1, and 26.12.1). On October 25, Microsoft released out-of-band .NET updates: .NET 8.0.33, .NET 9.0.22, and .NET 10.0.14. The same .NET release also corrects two fixes from October 13 that Microsoft says "did not fully address" CVE-2026-70197 and CVE-2026-102870. The upstream Brotli fix is in Brotli 1.2.1. (.NET announcement, Node.js)
Who is affected
Servers and apps that decompress Brotli data from outside. Node.js says an app is exposed when it decompresses attacker-supplied Brotli data with node:zlib. Microsoft says .NET apps are exposed only when they turn on Brotli decompression in ASP.NET Core or HttpClient, or call the Brotli APIs directly; "ASP.NET Core and HttpClient do not automatically decompress Brotli data in their default configurations." Microsoft also says ".NET Framework is not affected." (.NET advisory)
For a typical office, this means line-of-business web apps, customer portals, internal tools, and any server software built on Node.js or modern .NET.
What to check or fix now
- On servers that run web apps, list installed runtimes:
dotnet --list-runtimesandnode --version. - Update .NET to 8.0.33, 9.0.22, or 10.0.14, and Node.js to 22.23.4, 24.22.1, or 26.12.1.
- Restart the services that use them. A runtime update does nothing for a process that is still running the old code.
- Ask the vendors of hosted or appliance software that bundles Node.js, .NET, or Brotli whether their product includes the fix.
How to prevent it
Keep an inventory of which servers run which runtimes, so a library flaw like this becomes a list of machines to patch rather than a hunt. Node.js 20 and other end-of-life lines get no fix, so move apps off them. More on why patching comes first in why software updates are your first line of defense.
A UEFI firmware bug can hijack servers while they network boot
What happened
The TianoCore project, which maintains EDK II (the open-source code most UEFI firmware is built on), published a critical advisory on October 22 for CVE-2026-97631, rated 9.5. The bug sits in the PXE network boot driver. In the advisory's words, "While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated network attacker who can deliver ICMP error messages to it can corrupt DXE-phase memory and execute arbitrary code before the operating system loads, before Secure Boot or measured boot has verified or measured any OS component." ( TianoCore advisory)
The advisory's patched versions field reads "Not patched currently." A code fix exists in the project, but hardware makers still have to build it into their firmware and ship BIOS updates.
Who is affected
Machines whose firmware is built on EDK II and that boot over the network. The advisory limits the attack to the time a machine is PXE-booting. Ars Technica's reporting says the bug "doesn't affect home and small office users, or any other users who boot their devices solely from disk drives," and that PXE "is turned on by default" in affected firmware. (Ars Technica) In an office, that usually means servers, virtualization hosts, and any PC that is imaged over the network.
What to check or fix now
- In the firmware setup (or the server's remote management console), check whether network boot or PXE is turned on and listed in the boot order.
- Turn it off on machines that boot from their own disk and never use network imaging.
- Ask your server and PC vendors when a BIOS update with the fix for CVE-2026-97631 will ship, and plan to install it.
How to prevent it
Treat firmware like any other software: track BIOS versions on servers and check vendor support pages on a schedule. Keep network imaging on a separate network segment where it is still needed. For Secure Boot certificate changes that also live in firmware, see the FortiMail, Dell, and Secure Boot brief.
Windows and Edge stopped trusting seven eMudhra certificates
What happened
Microsoft says eight eMudhra intermediate certificate authority private keys "could be recovered," six for website (TLS) certificates and two for code signing. A key like that could be used to make a fake website certificate or sign malware so it looks trusted. Microsoft says it "was not a compromise of Microsoft systems." (Microsoft MSRC) eMudhra says the problem came from weak keys created during a key ceremony and that "no certificates had been issued from any of them." (eMudhra)
Microsoft blocked the affected certificate authorities through the Windows Disallowed Certificate Trust List on October 20. On October 26, it released out-of-band Windows updates that remove seven related certificates from the Windows trust list: KB5134133 for Windows 11 24H2, 25H2, and 26H2, and KB5134125 for Windows 10 21H2 and 22H2. On October 27, it removed the same seven certificates from the Microsoft Edge trust list.
Who is affected
Most Windows PCs get these changes automatically. Microsoft says the KB updates are "intended for devices that do not receive current certificate trust list (CTL) updates," such as disconnected devices, devices that cannot reach Microsoft's certificate-update service, and devices where automatic CTL updates are turned off. It also matters to anyone whose own certificates chain to one of the removed roots.
What to check or fix now
- Find PCs and servers that are offline, firewalled from the internet, or have automatic root certificate updates turned off, and install KB5134133 or KB5134125 on them.
- Check whether any website, VPN, or app certificate you use chains to an eMudhra root. If it does, get a replacement certificate before the change reaches your devices.
- Do not add the removed certificates back to trusted stores just to silence an error. Microsoft warns against restoring trust "without understanding the associated risk."
- On devices enrolled in Windows hotpatch, note Microsoft's warning: after installing KB5134133 they "will not receive hotpatch updates until after they install the January 2027 baseline update."
How to prevent it
Leave automatic certificate trust updates on unless you have a reason not to, and keep a short list of machines that are deliberately cut off from Microsoft's update services so they get these updates by hand. For another recent case of website certificates issued to the wrong party, see the rogue website certificates brief.
What to do this week
- List the .NET and Node.js runtimes on every server that runs a web app, update them to the fixed versions, and restart those services.
- Ask the vendors of your business web apps and appliances whether they include the Brotli fix.
- Turn off network boot (PXE) on servers and PCs that do not use it.
- Ask your server and PC vendors for BIOS updates that fix CVE-2026-97631, and schedule them.
- Install KB5134133 or KB5134125 on any Windows device that does not get automatic certificate updates.
If you need someone who can handle these checks for you, reach out to us. We would be happy to help.
Sources
- CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 27, 2026)
- NVD, CVE-2026-111497
- Microsoft .NET advisory for CVE-2026-111497
- Microsoft .NET October 2026 out-of-band updates
- Node.js October 21, 2026 security releases
- Brotli 1.2.1 release
- TianoCore EDK II advisory GHSA-99cj-7hg9-mp4m (CVE-2026-97631)
- NVD, CVE-2026-97631
- Ars Technica, code execution flaw in UEFI firmware (news coverage)
- Microsoft MSRC, response to compromised eMudhra certificate authority keys (October 26 and 27)
- Microsoft KB5134133, Windows 11
- Microsoft KB5134125, Windows 10
- eMudhra statement on the certificate security incident
Powerful IT Systems · Sussex, WI
Hands-on IT experience serving Milwaukee-area businesses.