MSRC publishes urgent guidance for Brotli, eMudhra and PHP2Shell remediation
Microsoft’s October 30 guidance clarifies which security fixes customers must apply themselves. It covers exploited PHP2Shell and Brotli vulnerabilities and the eMudhra certificate-authority key compromise, including newly released Visual Studio fixes.
Microsoft is patching the services it operates; customers remain responsible for manually maintained resources and software they install or bundle.
The guidance calls for rebuilding affected containers and self-contained . NET applications, updating application trust stores and replacing certificates that chain to removed roots. Out-of-band Brotli and eMudhra fixes require an additional restart.
These are remediation instructions, not a claim that every customer environment has already been patched.
Partner briefing
- What it is
MSRC consolidated remediation guidance for three security issues.
- What’s changing
The October 30 publication includes Visual Studio fixes and customer-managed software responsibilities.
- Why it matters
Host updates alone do not repair bundled runtimes or application trust stores.
- Who it affects
Administrators, developers and service providers maintaining affected customer systems.