Attackers hit Magento and Adobe Commerce stores in at least three regions with a new remote access trojan between September 9 and 13, 2026. They used StyleSmuggler, a maximum-severity flaw that Adobe had patched only two days before the campaign began. Researchers Daniel Johnston and Gabi Sharadin of Imperva Threat Research described the attacks in a detailed Imperva write-up on the PSK Agent campaign…

Introduction: As web application attack vectors grow increasingly sophisticated, enterprise web application firewalls (WAF) like Imperva serve as a primary line of defense against OWASP Top 10 exploits, botnet incursions, and volumetric DDoS attacks. Architecting and maintaining a modern Imperva deployment requires integrating traditional WAF policy tuning with Infrastructure as Code (IaC) via Terraform, SIEM automated logging, and cloud security controls across AWS, Azure, and GCP.

At a glance Malware family PSK Agent (Go-based RAT), a shell-script dropper, and a PHP webshell Threat actor Unnamed; likely Chinese-speaking, per Imperva (moderate confidence) Targets Magento and Adobe Commerce stores in Western Europe, North America, and Asia-Pacific Delivery vector StyleSmuggler exploitation of CVE-2026-75650 Key capabilities Remote command execution, SOCKS5 proxying, DNS victim tracking, persistence TL;DR Between September 9 and 13, 2026, Imperva detected attacks that dropped the PSK Agent RAT on Magento and Adobe Commerce stores.

Is Imperva down right now? Check the latest outage reports and share your experience. Get real-time alerts when Imperva is down.

Imperva demonstrated code execution via crafted Brotli data on an official Node.js 24.22.0 Linux arm64 image; Node.js has issued fixes.

Last Updated: 2026-10-27T20:00:43Z (UTC) CVSSv4: 9.2 What’s Happening On 2026-10-21T07:00:00Z (UTC) NodeJS patched a High severity vulnerability in the runtime involving the Brotli compression decoder. The vulnerability was a buffer overflow that could lead to remote code execution. On 2026-10-22T07:00:00Z (UTC), Imperva published a report demonstrating the remote code execution. Notably, Node was vulnerable in a default state, as was the express request handler. Imperva called this “Node2...

Sigue de lo de ayer, donde Broccoli2Shell aparecía todavía como una escritura fuera de límites en el decoder de Brotli alcanzable por cURL con la descompresión automática habilitada: el desarrollo nuevo es que la RCE dejó de ser un caso de laboratorio. A la prueba de concepto de Imperva en una…

Microsoft .NET Brotli Vulnerability: Urgent Security Patch Microsoft urgently deployed out-of-band security patches for the .NET framework. This critical update addresses a severe vulnerability within the Brotli compression algorithm. Hackers can exploit this flaw to compromise applications through manipulated compressed data payloads. Consequently, the cybersecurity community has dubbed this threat with various high-profile names. Security researchers have already released functional exploit examples online.

Sophisticated web application firewall that's a breeze to deploy, packed with sophisticated security features, and ideally suited to enterprises

Node.jsのセキュリティ上の欠陥により、悪意のある圧縮データがリモートコード実行（RCE）につながるおそれがあります。研究者は、改変されていない標準のランタイムに対する攻撃を実証しました。信頼できないBrotliデータを処理するアプリケーションには、懸念が高まっています。Impervaは2026年10月22日、

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Curate Feeds | Make Collections | Customize Email Briefs

Imperva Red Team demonstrated remote code execution against the official vulnerable Node.js build, then confirmed that the fixed release rejects the same Brotli input. Executive summary Node2Shell is ...