CISA added Adobe Commerce/Magento’s PolyShell flaw and Brotli-related CVE-2026-111497 to its KEV catalog. Reports describe ongoing PolyShell attacks and…

My roundup for Oct 26 to 31, 2026: PHP2Shell and Node2Shell hit KEV, plus Anthropic, OpenAI, Mistral, GitLab, Cisco ASA, PolyShell and ConnectWise.

Attackers used the PolyShell flaw to plant hidden code on hundreds of online stores. Who is affected, what shoppers should know and what owners must do now.

controlled by the threat actor read more about Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

A scanner-evading JavaScript loader infected nearly a thousand Magento stores; CISA added the upload flaw to its exploited catalog.

Haz clic para acceder al contenido completo.

Actively exploited Magento and Adobe Commerce file upload flaw (CVSS 9.3). Business impact, affected versions, APSB26-73 patch and compromise checks.

{{rh9e7yNRO}}

PolyShell ya entró en cientos de tiendas Magento sin pedir una sola contraseña. La falla de subida de archivos de Adobe Commerce y Magento quedó registrada el martes 27 de octubre en el Catálogo de Vulnerabilidades Explotadas Conocidas (KEV, por sus siglas en inglés) de la Agencia de Ciberseguridad y Seguridad de Infraestructuras de Estados Unidos (CISA), el listado oficial de fallos usados en ataques reales. El registro lleva el código CVE-2026-48356 y una puntuación de 9,3 sobre 10 en la base nacional de vulnerabilidades. Adobe, dueña de la plataforma, le asigna 9,6 en su propio boletín.

This edition covers Israeli spyware targeting Starlink, withheld FISA rulings, NYPD's tracker retreat, Tailscale SSH flaws, authenticator leaks, eMudhra purges, and PolyShell breaches.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The vulnerabilities are listed below - CVE-2026-111497 (CVSS score: 9.2) - An unchecked return value vulnerability in

CISA just warned that Adobe Commerce / Magento high-risk bug CVE-2026-48356 (PolyShell) is being actively exploited—and it’s now listed in CISA’s KEV for exploited vulnerabilities. Translation: many ecommerce sites aren’t getting “hit once and done.” They may be stuck in a long-term compromise chain. Sansec reported a long-running Magento campaign: starting around July 2025, attackers began injecting malicious JavaScript loaders into affected stores. They kept rotating domains to extend survival time. So far, 953 ecommerce websites are reported impacted. What makes it scary isn’t only the injection—it’s the workflow. After initial access, attackers write malicious loader logic into Magento DB tables like cms_block. Then your pages appear normal while they secretly fetch external scripts from attacker-controlled infrastructure. The payload adapts based on visitor fingerprinting, deciding what to deliver next—making static detection far harder. Even patching may not fully break persistence. Sansec found a fully patched site (Magento 2.4.7-p10) still had attacker-created admin accounts and a backdoor called GSocket. Don’t just patch—hunt for rogue cms_block content, suspicious admin users, upload artifacts, and backdoor signals, and keep monitoring with logs + IOCs. #Magento #CyberSecurity #CISA #EcommerceSecurity #PolyShell #KEV

Curate Feeds | Make Collections | Customize Email Briefs

CISA adds exploited Adobe Commerce and Google Brotli flaws to its KEV catalog as attackers breach stores and target vulnerable decoders.