Three CVSS 9.2 vulnerabilities in the Python imaging library, allow remote code execution and heap corruption via a single malicious image upload

Overview

Three critical Pillow vulnerabilities (CVSS 9.2, disclosed 2026-10-19) let a crafted EPS, TIFF or JPEG file trigger command execution or heap corruption in any Python service that processes user-supplied images. All are fixed in Pillow 13.0.0. The excerpts below are from the vulnerable source.

Pillow is one of the most popular Python packages, and the most popular image processing library, with an estimated 436M monthly downloads.

What is Pillow?

Pillow is an image-processing library for Python – a maintained fork of the original PIL (Python Imaging Library). It opens, converts, resizes, thumbnails and saves images across dozens of formats (JPEG, PNG, TIFF, GIF, WebP, EPS and more), and is a near-ubiquitous dependency: web frameworks (Django/Flask image handling), thumbnail and avatar pipelines, document and PDF tooling, and most Python machine-learning and computer-vision stacks pull it in directly or transitively.

Because it routinely parses untrusted, user-supplied image bytes, a memory-safety or injection bug in Pillow is reachable from a plain file upload across a huge range of services.

Compromised Packages

CVE-2026-112900 – EPS argument injection -> RCE

Pillow renders EPS images by shelling out to Ghostscript. `EpsImagePlugin.Ghostscript` passes the caller-controlled input filename after `-f` without converting it to an absolute path, so a filename that starts with `-` is parsed by Ghostscript as an option. Combined with Ghostscript’s `@argfile` syntax (a leading `@` names a file whose contents become extra arguments) and control of that file, an attacker who controls the filename Pillow opens can inject Ghostscript options and run arbitrary commands – even under the default `-dSAFER`.

CVE-2026-112393 – TIFF write heap overflow (BytesIO)

When a compressed TIFF is saved to a file-like object with no real OS file descriptor (e.g. `io.BytesIO`), Pillow routes libtiff’s output through its `_tiffWriteProc` callback. The grow loop sizes the reallocation from `state->size` (the prior buffer size) instead of `state->loc` (the current write position), so for output larger than 64 KiB libtiff can seek past the buffer and `_TIFFmemcpy` writes at `state->loc` beyond the allocation – a heap overflow, plus disclosure of stale heap bytes in the unwritten alignment gaps. Saving to a real file path (which has a `fileno()`) is not affected.

CVE-2026-112403 – JPEG draft/thumbnail heap overflow

Pillow’s JPEG decoder writes a full-width scanline into `state->buffer`, which is sized from the tile / draft extents (the unpacker), not from the JPEG header. An attacker who feeds a crafted 8-bit lossless (SOF3) JPEG to an application that requests downscaling via `draft()` or `thumbnail()` makes libjpeg produce lines wider than the buffer, overflowing the heap – crash, and potentially code execution. Newer libjpeg-turbo builds accept the malformed input that older libjpeg-turbo 2.x / IJG builds reject.

Recommendations

- Upgrade now. `pip install -U “Pillow>=13.0.0″` and rebuild any wheels, containers or base images that vendor it. This is the only complete fix for all three CVEs.

- Reduce the image attack surface. Accept only the formats you actually need; never pass an attacker-controlled filename to `Image.open()` for EPS, and keep the Ghostscript (`gs`) binary off hosts that process untrusted uploads (CVE-2026-112900 is only reachable when `gs` is present). Treat `draft()` / `thumbnail()` on untrusted JPEGs and TIFF saves to in-memory buffers as the sensitive paths.

On October 21, 2026, Node.js shipped security releases across all supported lines fixing a high-severity out-of-bounds write in the bundled Brotli decoder. A Node.js process that decompresses attacker-controlled Brotli data — including Brotli-encoded HTTP responses it fetches — can be driven to write past the end of its buffer, leaking memory or executing code with the process’s privileges.

What is Node.js?

Node.js is a widely used server-side JavaScript runtime that powers a large share of web backends, APIs, build tooling and serverless functions. It bundles Google’s Brotli library (`deps/brotli`) to back its built-in `zlib` Brotli support — `zlib.brotliDecompress()` / `brotliDecompressSync()`, streaming Brotli, and the transparent decoding of Brotli-encoded HTTP bodies (`Content-Encoding: br`).

Because decompressing untrusted Brotli is common (fetched HTTP responses, uploaded or proxied payloads), a decoder memory-safety bug is reachable from ordinary traffic across a huge range of services, and a WAF does not mitigate it.

Affected versions

CVE-2026-111497 – Brotli decoder out-of-bounds write -> RCE

Brotli can split literals, commands and distances into block types and switch between them mid-stream. `DecodeBlockTypeAndLength` returned a `BROTLI_BOOL`, overloading `BROTLI_FALSE` to mean both “invalid stream” (only one block type, so a block switch is illegal) and “needs more input.”

The block-switch callers treated that `BROTLI_FALSE` as recoverable – and `DecodeLiteralBlockSwitch` discarded the result entirely – so a malformed block switch did not stop decoding: the decoder continued with invalid state and wrote out of bounds.

Recommendations

- Upgrade now. Node.js 22.23.4 / 24.22.1 / 26.12.1. End-of-life lines (25.x, 23.x, = 20.x) get no fix – move to a supported line.

- Treat Brotli decompression of untrusted input as the sensitive path. Anything that calls `zlib.brotliDecompress(Sync)` on attacker data, or fetches Brotli-encoded responses (sends `Accept-Encoding: br`), including indirectly through libraries.

- Be wary of PoCs and “patch” scripts. Do not clone or run unverified exploit or patch scripts from public repos or social media; trust the Node.js advisory and the official releases.

OX Security tracked over 2.2 million publicly exposed PHP instances following disclosure. Within 24 hours, only 14,151 affected systems visible on Shodan had been patched. The rate at which critical vulnerabilities are discovered continues to outpace our ability to remediate them at scale

Overview

On October 21, PHP released emergency fixes for PHP2Shell, two critical vulnerabilities — CVE-2026-109618 and CVE-2026-109619 — that allow unauthenticated remote code execution in the PHP engine itself.

Governments and security agencies around the world urged organizations to patch immediately. Some took systems offline. But 24 hours later, our data shows just how slowly that remediation is actually happening.

OX Security tracked more than 2.2 million publicly visible PHP instances through Shodan over the 24 hours following disclosure. Of the 1,974,890 measurable instances running versions in the affected range after 24 hours, just 14,151 were showing one of the newly patched PHP versions.

That’s 0.7% patched.

Put another way, 99.3% were still not showing a patched PHP version 24 hours after emergency fixes became available.

And while patching accelerated over the course of the day, it barely dented the affected population. At our initial measurement, only 245 instances were showing a patched version. Twelve hours later, that number had risen to 4,519. After 24 hours, it reached 14,151.

We also broke the data down across popular PHP-based technologies including WordPress, phpMyAdmin, Drupal and Laravel. The pattern was consistent: Roughly 99% of the affected hosts we could measure were still not showing a patched PHP version.

The findings illustrate the challenge facing defenders as critical vulnerabilities and attacks happen faster than many organizations can remediate them. Even after an emergency patch, worldwide warnings and extraordinary attention, the overwhelming majority of the affected systems we could measure remained unpatched 24 hours later.

Methodology and limitations: OX Security queried Shodan over the 24 hours following disclosure. PHP versions were identified from version information exposed publicly by indexed hosts, including headers such as X-Powered-By. Hosts that do not expose their PHP version cannot be classified using this methodology and are not included in our affected-versus-patched calculations. Because Shodan is a continuously changing index, changes in the total number of indexed hosts should not on their own be interpreted as evidence that systems were patched, isolated or taken offline.

For a flaw of this severity, standard emergency playbooks dictate a ‘drop-everything’ response where patching and validation should take no more than an hour. Yet 24 hours later, 99.3% of affected systems remain unpatched. This gap highlights a dangerous disconnect: while deployment itself takes minutes, operational fear of breaking live production systems, complex dependencies, and delayed approvals still outweigh immediate security threats in the real world.

How Many PHP Instances Were Secured?

At our initial assessment, Shodan showed 2,224,364 publicly visible PHP instances. Of the instances whose versions we could classify, 1,991,515 were running versions in the affected range, while just 245 were showing one of the newly patched releases.

Around 233K instances contained an earlier version not vulnerable to PHP2Shell (PHP 5.3 and older). 

Twelve hours later, we identified 4,519 patched instances.

After 24 hours, that number had risen to 14,151 — just 0.72% of the measurable affected population.

What About PHP-Based Websites?

The same pattern appears across widely used PHP-based technologies, including WordPress, phpMyAdmin, Drupal, Laravel, Joomla, cPanel and Magento.

Among the affected hosts whose PHP versions we could identify through Shodan, roughly 99% were still not showing a patched PHP version after 24 hours.

The data covers only publicly indexed hosts that expose enough PHP version information for us to classify them, so it should not be read as an estimate of the total vulnerable population for any individual technology.

Conclusions

PHP2Shell triggered emergency patches, government warnings, and worldwide attention. Yet 24 hours later, 99.3% of the affected PHP instances we could measure were still not showing a patched version.

That gap matters beyond PHP.

Security teams are already dealing with a constant stream of critical vulnerabilities, active exploitation and software supply chain attacks. PHP2Shell arrived as organizations were also responding to incidents such as the LiteLLM compromise. When multiple emergency-grade issues arrive at once, the challenge is no longer simply knowing that something is critical. It is knowing what is exposed, what can actually be exploited, what matters most and what needs to be fixed first.

AI makes that problem harder. It is accelerating vulnerability research and making it easier to find and develop exploits for flaws buried in mature software. But organizations still have to identify affected systems, determine exposure, test updates, prioritize remediation and deploy fixes across real production environments.

We are getting faster at finding critical vulnerabilities than we are at removing them from the internet.

PHP2Shell may be an early indication of what that imbalance looks like at scale. If AI continues to accelerate vulnerability discovery, defenders will need to get better not only at patching quickly, but at understanding their attack surface, reducing unnecessary internet exposure and functionality, monitoring for exploitation, and prioritizing the vulnerabilities that create the greatest actual risk.

Finding vulnerabilities faster is only an advantage if defenders can fix them fast enough to keep up.

5 days after emergency fixes shipped, 93.6% of measurable PHP instances are still exposed

On October 21, the PHP project shipped emergency releases for PHP2Shell, a pair of critical flaws (CVE-2026-109618 and CVE-2026-109619) that give an unauthenticated attacker remote code execution inside the PHP engine itself. Security agencies issued urgent advisories, and some organizations pulled systems offline while they worked out their exposure.

In our first report, we found that 99.3% of the PHP instances we could measure were still unpatched after 24 hours. We kept watching. As of October 26, five days after disclosure, the picture has barely shifted – 93.6% still exposed. That’s roughly 15 out of every 16 hosts we can measure.

Approximately 1.33 million affected hosts run end-of-life PHP branches that no longer receive official fixes. For these systems, remediation may require a version update as well.

What we Measured

OX Security ran repeated Shodan queries from the first evening after disclosure through October 26, 2026. We classified each host by the PHP version it advertises publicly.

Hosts that hide their PHP version cannot be classified and are left out of every affected-versus-patched figure in this post.

Day by day: how far did patching get?

Our first scan, on the evening of October 21, found 2,224,364 PHP instances on Shodan. Of the 1,991,515 we could place in the affected range, only 245 were already on a fixed release. Five days later, that number is 127,430. That’s progress – a slow one.

No segment we measured has patched even a quarter of its affected hosts.

Conclusion: we missed the opportunity to get patches out the door

Remediation is too slow, while everyone panics about PHP CVEs, remediation isn’t in panic state, it barely crawls, with more headlines than fixed instances in the wild.

PHP2Shell is one of the most covered vulnerabilities of the year, and five days after the fix shipped, 93.6% of measurable instances are still exposed.

While everyone were looking at the “Steal My Bitcoin” challenge – giving a reward in the form of Crypto for whoever successfully exploits their PHP vulnerable site, we missed the opportunity to actually get our patches out the door – and now, when exploits are out there, proven in the wild and not just a speculation – we’ve left our most precious assets exposed for the next hacker to take advantage of.

TL;DR

- Security tool sprawl is the build-up of overlapping security tools that report the same risks separately and leave gaps between them.

- Consolidating static application security testing (SAST), software composition analysis (SCA), and cloud-native application protection platforms (CNAPPs) means mapping what each tool covers, unifying findings in one shared context from code to runtime, and retiring a tool only once its coverage is proven elsewhere.

- Sprawl costs application security (AppSec) programs in three ways: duplicate alerts for the same issue, coverage gaps at the seams between tools, and context lost between code and cloud.

- SAST, SCA, and CNAPP overlap where the pipeline meets the cloud, through infrastructure-as-code (IaC) and container image scanning, and stay distinct at the layer each one reads.

- The number of AppSec tools an enterprise needs is set by coverage layers, not a headcount: one source of findings per layer, and one place where those findings correlate.

- A phased plan of inventory, map, unify, and retire consolidates without losing coverage, provided a parallel run proves parity before any tool is switched off.

- Consolidating to cut license spend, or onto a loosely coupled portfolio of acquired products, trades one sprawl problem for another.

What Is Security Tool Sprawl?

Security tool sprawl is the accumulation of security tools bought to fill one gap at a time, each with its own console, policy set, and finding format, until their coverage overlaps in some places and leaves gaps in others. The result is more findings, more consoles, and less certainty about what is actually covered.

In application security (AppSec), the pattern is familiar. Static application security testing (SAST) covers first-party code, software composition analysis (SCA) covers open-source dependencies, and a cloud-native application protection platform (CNAPP) covers cloud posture and running workloads. Secrets detection, infrastructure-as-code (IaC) scanning, container scanning, and API discovery tools sit beside them, often owned by different teams. Each new category adds another tool unless an existing platform absorbs it. AI security posture management (AI-SPM) is the latest example, and it poses the same choice between one more point tool and a move to an AI-native platform.

What Does Tool Sprawl Cost an AppSec Program?

Most security leaders already suspect they have too many tools. In 2025 research by Barracuda and Vanson Bourne covering 2,000 senior security decision-makers, 65% said they have too many security tools or vendors, and 53% said their tools can’t be integrated. Those figures cover security tooling as a whole. For AppSec teams, the cost of sprawl shows up in three specific places.

#1. Alert Duplication

One vulnerable open-source package can surface three times: as an SCA finding in the repository, as a container image finding in the registry, and as a runtime finding in the CNAPP. Each arrives with its own severity score, its own owner, and its own ticket. Triage time goes to reconciling the same issue three times over, and fixes stall while teams work out whether three tickets describe one problem or three.

#2. Coverage Gaps

Tool scopes are drawn by vendors, not by risk. IaC templates can fall between a code scanner that ignores them and a CNAPP configured only for live cloud accounts. Secrets may be left to developer-side tooling that security never sees, and APIs may go uninventoried because no tool owns them. Every tool reports clean on its own scope, and nothing reports on the seams.

#3. Context Loss

Each tool sees one layer. A cloud finding without its source code can’t be routed to the developer who owns the fix, and a code finding without runtime context can’t be ranked by whether the code is deployed, exposed, or reachable. Cloud findings that lack source-code context get patched in place or parked, while code findings are prioritized on severity alone. Both teams end up working from partial evidence.

Where SAST, SCA and CNAPP Overlap, and Where They Don’t

SAST, SCA, and CNAPP overlap where the pipeline meets the cloud, and stay distinct at the layer each one reads. SAST alone reads first-party logic, SCA alone tracks dependency versions and licenses, and a CNAPP alone sees what is deployed and running.

What Each Category Covers

The Open Worldwide Application Security Project (OWASP) describes SAST as source code analysis that finds security flaws in source or compiled code, and notes that it is frequently unable to find configuration issues because they are not represented in the code. OWASP defines SCA as the process of automating application security for third-party and open-source components, including their licensing. For CNAPPs, Gartner’s mandatory features include auditing cloud configuration and identity permissions, visibility into the runtime state of workloads, and, at a minimum, IaC scanning and container registry scanning.

That last requirement is where a CNAPP reaches back into the pipeline that code security tools already cover. Dynamic and interactive application security testing (DAST and IAST) sit beside SAST as separate testing methods with their own coverage.

Vendors Are Converging From Both Sides

Category lines are blurring from both directions. CNAPP vendors now sell SAST, AppSec vendors partner with CNAPP vendors to bring runtime context into their findings, and vendors that began in open-source dependency scanning now sell SAST alongside SCA. Category labels no longer predict which tool covers what, which makes overlap harder to see from a procurement list.

One CVE, Four Detection Points

OX’s writeup of NGINX Rift (CVE-2026-42945), an NGINX vulnerability disclosed in May 2026, shows what useful overlap looks like. OX describes finding the same vulnerability at four points between the prompt and runtime:

- At the Prompt: OX VibeSec stops an AI coding assistant from suggesting or installing vulnerable NGINX versions before the code is written.

- In the Repository: OX Code finds vulnerable NGINX versions pinned in Dockerfiles, Helm charts, Terraform modules, Kubernetes manifests, and other IaC, including in container layers.

- In the Running Environment: OX Cloud inventories cloud workloads, fingerprints the NGINX version on each, and confirms which vulnerable instances are loaded and exposed to the internet.

- Through Exploitation: OX Agentic Pentester runs a specific attack sequence against the exposed instance to produce a reproducible proof of exploit.

Overlap across lifecycle stages is useful coverage when the four detections resolve to one issue with one owner. It becomes noise when four tools file four tickets.

How Many AppSec Tools Does an Enterprise Actually Need?

There is no correct number of tools. The count that matters is one source of findings for each coverage layer, and one place where those findings correlate.

NIST’s Secure Software Development Framework (SSDF), SP 800-218, is a practical way to define those layers, because it names practices rather than products:

- PW.4, Reuse Existing, Well-Secured Software When Feasible Instead of Duplicating Functionality: Includes verifying that acquired third-party and open-source components meet security requirements, the work SCA serves.

- PW.7, Review and/or Analyze Human-Readable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements: The work SAST serves.

- PW.8, Test Executable Code to Identify Vulnerabilities and Verify Compliance with Security Requirements: The work dynamic testing serves.

- RV.1, Identify and Confirm Vulnerabilities on an Ongoing Basis: Depends on findings from every layer once software is released.

The SSDF names tools only as examples, so it describes what must be covered rather than what must be bought. It also stops at development: cloud posture and runtime sit outside its scope, and that is the CNAPP’s layer (for how the framework applies in practice, see what the SSDF asks of AppSec teams). An enterprise therefore needs coverage for first-party code, dependencies, executable testing, cloud posture, and runtime, plus one place where findings from all of them correlate. Whether that takes five tools or one platform depends on whether those findings share context.

How to Reduce Application Security Tool Sprawl: A Phased Consolidation Plan

Consolidation works best as four phases run in order, with coverage verified before anything is switched off. The pressure behind it is broad: in Cisco’s 2025 Cybersecurity Readiness Index, a double-blind survey of 8,000 security and business leaders in 30 markets, more than 77% of organizations reported complex security infrastructures, dominated by more than ten point solutions, that impede their ability to respond to threats. Because tools are retired against their contract renewal dates, expect the work to span several renewal cycles rather than a single quarter.

Inventory

Start with a complete list of every security tool in use: who owns it, when its contract renews, which repositories, pipelines, and cloud accounts it covers, and who acts on its findings. Include the shadow tools bought by individual teams, since they often cover ground the central program assumes is uncovered, or duplicate what it already runs.

Map

Plot each tool against the coverage layers above and mark three things: layers covered twice, layers covered by nothing, and findings that duplicate across tools. The map sets the order of everything that follows. Gaps are closed first, and duplicated layers become the candidates for retirement.

Unify

Bring findings from the remaining tools into one platform that correlates them across code, pipeline, cloud, and runtime, so that a single issue carries its source, its deployment, and its reachability.

Norwalk, Conn. —

Xerox today announced it has been positioned as a Leader in Quocirca’s 2026 Automation & AI, Cloud & Technology assessment, which evaluates vendor capability across Automation & AI, Cloud, and Technology Ecosystems.

The Leader position reflects the breadth and maturity of the Xerox integrated portfolio, bringing together Automation and AI, Cloud, and ecosystem‑driven services to deliver tangible outcomes for clients. Building on a long heritage of simplifying work and modernizing workflows, Xerox now applies AI as a foundational capability across its offerings. This includes predictive maintenance, workflow automation, intelligent document processing, and production optimization, supported by cloud platforms and partner ecosystems to scale securely across distributed environments.

The ACT assessment recognizes vendors that demonstrate the strategic vision, execution strength, and integration required to move beyond standalone technologies and support enterprise‑wide transformation. Recognition in the Leader category underscores the evolution of Xerox into a services‑led, software‑enabled technology partner, helping organizations reduce complexity and adapt to changing work models.

“Xerox distinguishes itself in the ACT landscape through the depth, integration, and operational maturity of its automation, AI, and cloud capabilities,” said Louella Fernandes, CEO of Quocirca. “With intelligence embedded across devices, platforms, and services, reinforced by a strong technology ecosystem and growing IT services portfolio, Xerox exemplifies what we expect from ACT Leaders: a clear strategic vision, proven global execution, and the ability to act as a true pacesetter for customer transformation and innovation.”

The recognition also reflects the continued growth of Digital Services and Xerox IT Solutions, alongside progress integrating Lexmark, strengthening the ability of Xerox to deliver higher value, recurring digital and IT services at scale.

“This recognition reflects the progress we’ve made integrating AI, automation, cloud, and IT into a more connected platform that helps clients simplify operations and adapt more quickly to changing business demands,” said Munu Gandhi, president of Xerox IT Solutions and chief technology officer at Xerox. “As we continue to scale the business, we remain focused on delivering practical innovation, operational excellence, and long-term value for our clients.”

For more information, visit www.xerox.com.

About Xerox Holdings Corporation (NASDAQ: XRX)

Xerox has been redefining the workplace experience for over a century. As a services-led, software-enabled company, we power today’s hybrid workplace through advanced print, digital, and AI-driven technologies. In 2025, Xerox acquired Lexmark, expanding our global footprint, strengthening service capabilities, and equipping us to deliver an even broader portfolio of workplace technologies to our clients. Today, we continue our legacy of innovation to deliver client-centric, digitally driven solutions that meet the needs of a global, distributed workforce. Whether in offices, classrooms, or hospitals, we help our clients thrive in a constantly evolving business landscape.

Norwalk, Conn. —

Xerox today introduced the Xerox® C240/C245, Xerox® C255a, and Xerox® C300/C303a/C305ae color printers and multifunction printers, the first hardware offerings launched under the unified Xerox brand following the company's integration with Lexmark.

Xerox now operates as a single technology company spanning print, IT infrastructure and intelligent digital services. The updated Xerox brand identity, including the refreshed logo, reflects the next phase of transformation into a stronger, more competitive technology company. The combined portfolio reflects capabilities from both organizations, and the Xerox C240/C245, Xerox C255a, and Xerox C300/C303a/C305ae are the first products to bring that combined portfolio to market.

"The integration of Xerox and Lexmark has expanded what we can deliver, and these products reflect that directly," said Jacques-Edouard Gueden, chief revenue officer at Xerox. "This product line gives our clients in the small workgroup segment a reliable, straightforward solution built on the combined resources of both companies, and our channel partners a stronger portfolio to sell."

Designed for Small Workgroups and Hybrid Environments

The A4 small workgroup segment represents a growing area of demand, driven by the expansion of hybrid work and the need for print solutions that can be deployed without dedicated IT support. The Xerox C240/C245, Xerox C255a, and Xerox C300/C303a/C305ae address that need directly with a compact footprint, simplified setup and built-in security.

Key capabilities include:

- Ease of use: Intuitive interfaces, simplified setup and support for the Xerox® Easy Assist App and Xerox® Print and Scan Experience App help users install, manage, print and scan with ease. No IT support required.

- Performance: The Xerox C240/C245 and Xerox C255a, are designed for reliable, consistent everyday use, while the Xerox C300/C303a/C305ae are also designed to support a broader range of small workgroup needs, including more demanding environments

- Security: Built-in security features help protect devices, documents, and network access, with integrated post-quantum cryptography (PQC) support for future-ready protection against evolving cyber threats.

- Compact design: Space-efficient form factors suited for small offices and shared workspaces

- Sustainability: Energy-efficient operation and more than 50% post-consumer recycled plastic content aligned with Xerox commitment to responsible innovation

The Xerox C240/C245, Xerox C255a, and Xerox C300/C303a/C305ae are now shipping in North America, Western Europe, Australia, and New Zealand. Availability in additional regions will be announced as the global rollout continues. Learn more at xerox.com.

About Xerox Holdings Corporation (NASDAQ: XRX)

Xerox is a global technology company with more than 120 years of innovation leadership. We design, manufacture, deliver, and support print, IT, and digital services for nearly 200,000 clients worldwide. Our integrated, AI-powered portfolio includes managed and production print, document management, workflow automation, cybersecurity, cloud managed services, IT infrastructure, and collaboration technology. Serving clients from growing SMBs to 90 percent of the Fortune 500, Xerox supports leading healthcare, government, financial services, education, legal, retail, and commercial organizations. Through direct sales and a global network of channel partners, we deliver the technology, expertise, and support organizations need to operate efficiently, securely, and at scale.

-XXX-

Norwalk, Conn. —

Xerox today announced it has been positioned for the fifth consecutive year as a Leader in Quocirca’s Cloud Print Services Landscape 2026, which evaluates vendor capabilities in delivering cloud-based print management and related digital services. Xerox was ranked strongest in the market on both strategy and completeness of offering.

Quocirca highlights Xerox strengths in platform depth, security, and workflow integration, underpinned by advanced analytics and a cloud-first architecture that makes enterprise-grade capabilities accessible to SMB and mid-market organizations, while enabling partners to deliver high-value, scalable services to a broader client base. Built on a multi-tenant SaaS architecture aligned to zero trust principles, the Xerox cloud ecosystem is designed to reduce IT complexity while enabling scalable, secure, and flexible operations. Clients are further supported by broad IT services capabilities, enabling the design, migration, and management of secure cloud and hybrid environments.

“Xerox stands out in the cloud print services market through its cloud-first strategy, multi-tenant architecture, and strong focus on analytics and workflow automation,” said Louella Fernandes, CEO of Quocirca. “By combining secure, scalable cloud platforms with integrated workflow and AI-enabled capabilities, Xerox is well positioned to help organizations navigate the shift toward hybrid work and more intelligent, connected document environments.”

Xerox continues to advance its cloud capabilities, strengthened by the integration of Xerox and Lexmark cloud platforms. Together, these platforms provide global connectivity, real-time device intelligence, and expanded analytics, enabling consistent service delivery across distributed and hybrid environments.

“This recognition underscores the progress we’ve made building a cloud-first platform that brings together print, workflow automation, analytics, and security into a connected ecosystem,” said Munu Gandhi, president of Xerox IT Solutions and chief technology officer at Xerox. “As organizations modernize how information flows across their business, our focus is on helping clients reduce complexity, improve visibility, and leverage AI-enabled workflows to drive greater efficiency, agility and long-term value."

Cloud-based print is increasingly part of a broader shift toward AI-enabled, integrated document workflows required as organizations accelerate digital transformation. Quocirca recognizes Xerox capabilities that extend beyond traditional print management into workflow automation, analytics, and intelligent document processing, helping organizations modernize infrastructure and improve operational efficiency.

For more information on the company’s cloud print offerings, visit www.xerox.com/en-us/services/managed-print-services/cloud-solutions.

About Xerox Holdings Corporation (NASDAQ: XRX)

Xerox is a global technology company with more than 120 years of innovation leadership. We design, manufacture, deliver, and support print, IT, and digital services for nearly 200,000 clients worldwide. Our integrated, AI-powered portfolio includes managed and production print, document management, workflow automation, cybersecurity, cloud managed services, IT infrastructure, and collaboration technology. Serving clients from growing SMBs to 90 percent of the Fortune 500, Xerox supports leading healthcare, government, financial services, education, legal, retail, and commercial organizations. Through direct sales and a global network of channel partners, we deliver the technology, expertise, and support organizations need to operate efficiently, securely, and at scale. 

-XXX-

The New York Jets have partnered with Xerox, one of the world’s most recognized technology leaders, in a new multi-year agreement focused on integrating technology across the team’s day-to-day football and business operations. As a central part of the relationship, Xerox solutions are being implemented throughout the organization, including document management, printing infrastructure, and internal workflows across both the training facility and front office.

“We’re excited to welcome Xerox into the Jets family,” said Jeff Fernandez, Jets Senior Vice President of Business Development + Ventures. “This partnership is about putting their technology to work to support how we operate and improve efficiency across the organization on a daily basis.”

Xerox will work closely with the Jets’ IT team to showcase how its solutions can enhance productivity, streamline workflows, and support the demands of a fast-paced, high-stakes environment. It will provide the opportunity to highlight how Xerox solutions are applied within a professional sports environment through a custom content feature.

"In professional sports every decision matters and every second counts, and that's exactly the kind of environment where Xerox thrives,” said Darren Cassidy, chief marketing officer at Xerox. "By integrating our document management and workflow automation solutions across the Jets training facility and front office, we're helping the organization eliminate friction and focus on winning. Through the Jets Partner Alliance, we're creating connections between great businesses that share a commitment to operational excellence."

The partnership also includes supporting sponsorship of the Jets Partner Alliance, providing Xerox access to a year-round B2B platform connecting leading brands across the team’s network, reinforcing a shared focus on driving meaningful B2B relationships through sports.

Xerox will also be featured across Jets gameday platforms at MetLife Stadium and have access to hospitality and partner engagement opportunities throughout the season.

About Xerox Holdings Corporation (NASDAQ: XRX)

Xerox is a global technology company with more than 120 years of innovation leadership. We design, manufacture, deliver, and support print, IT, and digital services for nearly 200,000 clients worldwide. Our integrated, AI-powered portfolio includes managed and production print, document management, workflow automation, cybersecurity, cloud managed services, IT infrastructure, and collaboration technology. Serving clients from growing SMBs to 90 percent of the Fortune 500, Xerox supports leading healthcare, government, financial services, education, legal, retail, and commercial organizations. Through direct sales and a global network of channel partners, we deliver the technology, expertise, and support organizations need to operate efficiently, securely, and at scale.

About New York Jets

The New York Jets were founded in 1959 as the New York Titans, an original member of the American Football League (AFL). The Jets won Super Bowl III, defeating the NFL’s Baltimore Colts in 1969. In 1970, the franchise joined the National Football League in the historic AFL–NFL merger that set the foundation for today’s league. As part of a commitment to its fan base through innovation and experiences, the team has created initiatives such as, its trailblazing Jets Rewards program, a state-of-the-art mobile app, and 1JD Entertainment, a comprehensive content platform that gives fans greater access to the team across all digital and social platforms. The organization takes great pride in a long-standing, year-round commitment to their community. These programs are funded by the New York Jets Foundation and look to positively influence the lives of young men and women in the tri-state area, particularly in disadvantaged communities. The organization supports the efforts of the Lupus Research Alliance, youth football and numerous established charitable organizations and causes sponsored by the NFL. The New York Jets play in MetLife Stadium, which opened in 2010, and are headquartered at the Atlantic Health Jets Training Center in Florham Park, New Jersey. For more information about the New York Jets visit newyorkjets.com.

Norwalk, Conn. —

Financial Summary

- Revenue of $1.92 billion, up 22.0 percent, or 21.2 percent in constant currency1. On a pro forma2 basis, revenue is down 6.5 percent.

- GAAP net income of $13 million, or $0.07 per share, up $119 million or $0.94 per share, year-over-year, respectively.

- Adjusted1 net income of $55 million, or $0.38 per share, up $132 million or $1.02 per share, year-over-year, respectively.

- Adjusted1 operating income of $203 million, up $144 million year-over-year.

- Adjusted1 operating margin of 10.6 percent, up 690 basis points year-over-year.

- Operating cash flow of $37 million, up $48 million year-over year.

- Free cash flow1 of $11 million, up $41 million year-over-year.

* Profitability metrics for Q2 2026 include $105 million of a pre-tax benefit from the recognition of IEEPA tariff receivables. This benefit is not included in either Operating cash flow or Free cash flow for Q2 2026 as the sale of the receivables is currently accounted for within Financing cash flow.