LightNews — News, ranked by scholars

Martin Konvis

@konvis.bsky.social

Magento Patch November 2026 – kommt am 10. November ein neuer Sicherheitspatch? # magento # magento-2 # magento-hilfe # magento-wartung https://www.konvis.de/neuigkeiten/magento/magento-patch-november-2026-kommt-am-10-november-ein-neuer-sicherheitspatch/

November 4, 2026 at 1:29 PM

Martin Konvis

@konvis.bsky.social

Magento-Sicherheitspatches 2026 und die Folgen für die laufenden Wartungskosten # magento # magento-2 # magento-patch # magento-update https://www.konvis.de/neuigkeiten/magento/magento-sicherheitspatches-2026-und-die-folgen-fuer-die-laufenden-wartungskosten/

November 2, 2026 at 6:50 PM

Circuit & Capital

@circuitandcapital.bsky.social

Next week: four CISA KEV due dates (Nov 10–13) plus Microsoft and Fortinet on Patch Tuesday. Magento, Brotli, VMware ESX, and Ivanti in one window. Calendar for small IT teams:
circuits.fit/articles/kev...

KEV deadlines and Patch Tuesday: the Nov 10-13 patch calendar

CISA KEV due dates Nov 10-13, 2026 (Magento, Brotli, VMware ESX, Ivanti) plus Microsoft and Fortinet on Patch Tuesday Nov 10. A one-page plan for small IT teams.

circuits.fit

November 4, 2026 at 6:26 PM

The Hot Drop

@thehotdrop.live

Sansec reports 953 Magento stores hit by a long-running skimmer campaign hiding JavaScript in CMS blocks. Patch Adobe Commerce now.

YouTube: www.youtube.com/shorts/gKdw3...

#Cybersecurity #Magento #eCommerce

953 Magento Stores Hit by a Skimmer Campaign

Sansec reports 953 Magento stores hit by a long-running skimmer campaign hiding JavaScript in CMS blocks. Patch Adobe Commerce now.

www.youtube.com

October 27, 2026 at 9:00 PM

phpscientist.bsky.social

@phpscientist.bsky.social

PolyShell (CVE-2026-48356): The Actively Exploited Magento Flaw Every Store Owner Must Act On phpscientist.com/blog/magento...

Magento PolyShell CVE-2026-48356: Risk and How to Patch

Actively exploited Magento and Adobe Commerce file upload flaw (CVSS 9.3). Business impact, affected versions, APSB26-73 patch and compromise checks.

phpscientist.com

October 28, 2026 at 2:48 PM

ThreatRoundup

@threatroundup.bsky.social

CISA put PolyShell (Magento) and the Brotli 'Node2Shell' bug on its exploited list, due Nov. 10. ELLIO logged the first Node2Shell exploit traffic. Patch Node.js and Magento now.

threatroundup.com/news/cisa-ke...

October 29, 2026 at 2:28 AM

Circuit & Capital

@circuitandcapital.bsky.social

CISA's catalog now lists Magento, Brotli and on-prem VeloCloud Orchestrator bugs as exploited. In each case the patch likely sits with an agency, a vendor or a network provider. This week's job: find out who owns each fix and get a dated answer.

CISA added Magento and a compression library. Ask who owns the patch. — Circuit & Capital

CISA KEV added Adobe Commerce/Magento CVE-2026-48356 and Google Brotli CVE-2026-111497 on October 27, 2026 (due November 10), and Arista VeloCloud Orchestrator CVE-2026-114625 on October 23. Affected ...

circuits.fit

October 28, 2026 at 5:30 PM

mariogalarza.bsky.social

@mariogalarza.bsky.social

CISA adds 2 actively exploited flaws to KEV: Adobe Commerce/Magento upload flaw CVE-2026-48356 + Google Brotli CVE-2026-111497. Patch now, then hunt for pre-patch compromise. https://www.linkedin.com/feed/update/urn:li:share:7520978454234849280/

October 27, 2026 at 10:43 PM

Daily CyberSecurity

@securityonline.bsky.social

CISA KEV catalog adds actively exploited Magento flaw CVE-2026-48356 and Brotli vulnerability CVE-2026-111497. Patch before November 10.

#CISA #KEV #Magento #AdobeCommerce #Brotli #CVE202648356 #CVE2026111497 #ActiveExploitation

CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog

TL;DR On October 27, CISA added two actively exploited flaws to its Known Exploited Vulnerabilities list, better known as the CISA KEV catalog. The first, CVE-2026-48356, hits Adobe Commerce and Magento. The second, CVE-2026-111497, is a Brotli vulnerability in Google's widely used compression library. CISA says it has evidence of active exploitation for both flaws. Federal agencies must patch by November 10, 2026.

securityonline.info

October 27, 2026 at 11:52 PM

ninjaintelgroup.bsky.social

@ninjaintelgroup.bsky.social

🚨 NEW on CISA KEV — exploited in the wild
Adobe Commerce and Magento: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability
CVE-2026-48356 · patch by 2026-11-10
🔗 https://ninjasignal.ninja/intel/cve/CVE-2026-48356
#KEV #cybersecurity #infosec

October 27, 2026 at 8:15 PM

The Hot Drop

@thehotdrop.live

AI agents breached 100+ orgs through unprotected panels, and a CVSS 10 Magento flaw lets unauthenticated attackers run PHP code. Patch now.

YouTube: www.youtube.com/shorts/TDNxJ...

#Cybersecurity #Magento #AI

Critical Magento Patch: Do This Immediately

AI agents breached 100+ orgs through unprotected panels, and a CVSS 10 Magento flaw lets unauthenticated attackers run PHP code. Patch now.

www.youtube.com

October 23, 2026 at 8:00 PM

OffSequence

@offseq.bsky.social

Malware campaign (HIGH) infects 953 Magento stores since July 2025 🛒 Loader code evades detection & exploits known CVEs. Review for rogue admin accounts, backdoors, and patch ASAP. https://radar.offseq.com/threat/953-online-stores-infected-in-long-lasting-malware-campaign-884b9644d42ac663 #OffSeq...

953 Online Stores Infected in Long-Lasting Malware Campaign

Since July 2025, a threat actor has infected 953 online stores, mostly running Magento, by injecting small loader code that either serves a malicious payload to visitors or remains dormant to avoid detection. The campaign utilized five diff

radar.offseq.com

October 26, 2026 at 1:30 PM

Roland Villemoes

@rolandvillemoes.bsky.social

Thinking about every Magento merchant who told me “we’re fine for now, we’ll replatform in 2027.”

Hope Wednesday and Today(Thursday) went okay for you. No lecture from here. Please get that Patch in.

We can talk about 2027 next week.

#magento #PHP2Shell

October 22, 2026 at 7:14 PM

The Hot Drop

@thehotdrop.live

PHP patched critical flaws after pre-disclosure leaks: five new CVEs, two at CVSS 9.2, one already in KEV. Magento, WordPress and Drupal sites are exposed. Patch now.

YouTube: www.youtube.com/shorts/Xshtj...

#cybersecurity #PHP #PatchNow

Don't Get Pwned: Critical PHP Flaws, Patch Now

PHP patched critical flaws after pre-disclosure leaks: five new CVEs, two at CVSS 9.2, one already in KEV. Magento, WordPress and Drupal sites are exposed. Patch now.

www.youtube.com

October 22, 2026 at 5:27 PM

Some call me... Tim?

@tjmoore.co.uk

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and (2/11)

October 22, 2026 at 11:58 AM

Death

@insatiableone.bsky.social

Now with alt text

@fiveoutofnine
So basically, today PHP got two bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline,' and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like 'take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline and Finland and France and Denmark started pulling government sites and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with [continued]

stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.
7:12 PM . Oct 21, 2026 - 255.1K Views
💬172
🔁21.3K
❤️8.9K
📖2.8k

October 22, 2026 at 9:22 PM

Get Alt Text

@alt-text.bsky.social

Alt text retrieved

%0◉ @fiveoutofnine So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down,

and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP. Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting

down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday. 7:12 PM - Oct 21, 2026 255.1K Views 172 1.3K 8.9K ☐ 2.8K +

October 24, 2026 at 5:57 AM

Toby Bartels

@tobybartels.name

Same picture as the OP. A post on Twitter by 5⁄9 @fiveoutofnine (verified), posted 7:12 PM Oct 21, 2026, with 255.1K views, 172 replies, 1.3K retweets, 8.9K likes, and 2.8K saves. Here is the first half of the tweet's text:

So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel, and Censys says like 1.5 million servers are running a version with no fix, so the NSA was like "take your system offline," and the FBI was like "take your system offline," and CISA and the UK and CERT-EU were all like "take your system offline," and then the Prime Minister of Japan, the actual Prime Minister, posted at 5:55 in the morning telling 48.8 million people to take their system offline, so everyone took their system offline, like the Dutch cybersecurity agency took its own website offline, and the Dutch parliament went offline, and the Port of Rotterdam went offline, and Finland and France and Denmark started pulling government sites, and Wikipedia went down, and Archive.org went down, and Asana and GOG and Something Awful went down, and the University of Vienna's webmail went down for some reason, and that's just PHP.

Same picture as before. Here is the second half of the tweet's text:

Because GitLab also dropped a CVSS 10.0, which is the highest score they give out, for a bug that's been there since 2014, so that's every self-hosted GitLab for twelve years, and then LiteLLM 1.107.0 got hijacked and shipped a credential stealer and a remote access trojan in every single wheel and the Docker images, including latest, and you didn't even have to import it, just installing it was enough, and it's the second time this year, and then Railway paused every deployment on the entire platform because someone got into the environment variables, so now everyone has to rotate every secret they've ever stored there, and TiDB Cloud said someone was walking around inside with stolen credentials for basically a month and an extortion group says they took 10.6 terabytes, and Zeabur got breached for the second time in two months and is just shutting down, like the whole company, and Node.js patched remote code execution and a TLS bypass, and CISA says Plex is being actively exploited, and someone took over 300 Tor exit relays to steal SSH passwords, and SafePay ransomware has hit over 600 critical infrastructure orgs, and India's biggest bank filed a data loss incident, and Japan has been in an official state of emergency in cyberspace since October 9, which honestly explains the 5:55 AM post. Oh, and eMudhra, a certificate authority that's issued over 60 million certificates, whose entire job is proving websites are who they say they are, was supposed to be using private keys that are random numbers over a hundred digits long, and one of them was 4. Just 4. And the others were like 66 and 237. Anyway, it's Wednesday.

October 22, 2026 at 10:14 PM

Mark Nelson

@sphericalsquare.bsky.social

Another fun day on the internet.
Somebody released a vulnerability that affects about 70% of websites, with the only safe fix until the patch is applied being turn your site off.

All Magento and Wordpress sites would be affected, which is a lot!

www.ncsc.gov.uk/news/critica...

Critical security issue affecting PHP

Updated: The NCSC is encouraging UK organisations to take immediate action to mitigate a security issue affecting PHP (CVE-2026-109618 and CVE-2026-109619).

www.ncsc.gov.uk

October 21, 2026 at 2:45 PM

Retweeted by Trenton Bricken [UNOFFICIAL]

@trentonbric-mir-rt.selfhosted.social

RT @fiveoutofnine: So basically, today PHP got two critical bugs that let anyone run code on your server without even logging in, which is bad, and then the details leaked before the patch was even out, which is worse, and it works on WordPress and MediaWiki and Magento and Joomla and Laravel,

Internet Archive: Digital Library of Free & Borrowable Texts, Movies, Music & Wayback Machine

archive.org

October 23, 2026 at 6:16 AM

call_user_func

@throwable.bsky.social

📦 stacknuts/magento-stackgauge v0.8.0

Reports version, patch, and operational health data from a Magento store to a central StackGauge fleet dashboard, so an agency can see every client site's update/security posture at a glance.

🔗 https://github.com/StackNuts/magento-stackgauge

October 20, 2026 at 3:22 PM

arfyfr.bsky.social

@arfyfr.bsky.social

Korben - Failles critiques dans PHP - patch d'urgence aujourd'hui à 16 h, la France en première ligne - https://arfy.fr/dotclear/index.php?post/2026/10/22/Korben-Failles-critiques-dans-PHP-patch-d-urgence-aujourd-hui-a-16-h--la-France-en-premiere-ligne

Korben - Failles critiques dans PHP - patch d'urgence aujourd'hui à 16 h, la France en première ligne

arfy.fr

October 22, 2026 at 7:04 AM

Martin Konvis

@konvis.bsky.social

Adobe korrigiert Oktober-Patch für 2.4.8-p5 # beratung # magento # magento-2 # magento-patch https://www.konvis.de/neuigkeiten/magento/adobe-korrigiert-oktober-patch-fuer-2-4-8-p5/

October 19, 2026 at 8:22 AM

Daily CyberSecurity

@securityonline.bsky.social

A PHP security release on Oct 21 fixes two CVSS 9.2 flaws, CVE-2026-109618 and CVE-2026-109619, leaked as remote code execution bugs.

#PHP #CVE2026109618 #CVE2026109619 #RemoteCodeExecution #WebSecurity #ZeroDay #PatchNow #CyberSecurity

PHP Prepares Emergency Fix for Two Critical Flaws After Leak Reveals RCE Risk

TL;DR The PHP team will ship a security release on October 21, 2026, at 14:00 UTC to fix two critical flaws rated CVSS v4.0 9.2. Leaks tie them to CVE-2026-109618 and CVE-2026-109619, described as remote code execution bugs in PHP core. Admins should prepare to patch the moment this PHP security release lands. Why It Matters PHP runs WordPress, Drupal, Magento and most shared hosting.

securityonline.info

October 20, 2026 at 11:27 PM

TrustList

@trustlist.bsky.social

Security advisories 18/20
Magento BlockStrap flaw rated 10.0 needs a manual patch

Adobe fixed the unauthenticated code-execution bug in APSB26-153 on 13 October, but a plain Composer install stays vulnerable, Open Source 2.4.6 and older…

#infosec #cybersecurity
trustlist.uk/security-advisorie…

Magento BlockStrap flaw rated 10.0 needs a manual patch

Adobe fixed the unauthenticated code-execution bug in APSB26-153 on 13 October, but a plain Composer install stays vulnerable, Open Source 2.4.6 and older get no public patch, and the September…

trustlist.uk

October 19, 2026 at 9:08 PM

Add to Home Screen

News, ranked by scholars

Sign in to LightNews

Sign up to start reading

Connect Bluesky

Connect with Bluesky