In freier Wildbahn wurden Angriffe auf kritische Sicherheitslücken in Brotli, Adobe Commerce und Magento beobachtet. Updates helfen.

controlled by the threat actor read more about Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

At a glance Malware family PSK Agent (Go-based RAT), a shell-script dropper, and a PHP webshell Threat actor Unnamed; likely Chinese-speaking, per Imperva (moderate confidence) Targets Magento and Adobe Commerce stores in Western Europe, North America, and Asia-Pacific Delivery vector StyleSmuggler exploitation of CVE-2026-75650 Key capabilities Remote command execution, SOCKS5 proxying, DNS victim tracking, persistence TL;DR Between September 9 and 13, 2026, Imperva detected attacks that dropped the PSK Agent RAT on Magento and Adobe Commerce stores.

TL;DR On October 27, CISA added two actively exploited flaws to its Known Exploited Vulnerabilities list, better known as the CISA KEV catalog. The first, CVE-2026-48356, hits Adobe Commerce and Magento. The second, CVE-2026-111497, is a Brotli vulnerability in Google's widely used compression library. CISA says it has evidence of active exploitation for both flaws. Federal agencies must patch by November 10, 2026.

Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on sto...

Adobe Commerce, including its B2B and Magento Open Source versions, lets an attacker store harmful code in certain form fields.

Adobe Commerce, including its B2B and Magento Open Source versions, can be tricked into accepting malformed input.

Adobe Commerce, including the B2B edition and Magento Open Source, can be tricked into executing attacker‑controlled code without any user click.

Adobe Commerce, including its B2B and Magento Open Source editions, can let a malicious user place harmful code into certain form fields.

Adobe Commerce, including its B2B and Magento Open Source versions, has a weakness that allows an attacker to run any code on the system as the currently.

An Attacker Leaves His Own Door Open An attacker hacked thousands of shops. Then he left the door to his own infrastructure open. A check of an exposed server run by the Lockster operator showed the scale of the damage. Through a critical zero-day in Magento Open Source and Adobe Commerce, attackers compromised at least 3,834 sites. Most were online stores.

The Cybersecurity and Infrastructure Security Agency (CISA) warns that hackers are exploiting a critical authentication bypass vulnerability (CVE-2026-5430) affecting multiple products from enterprise software provider WSO2.

 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical vulnerabilities affecting WSO2 and Adobe Commerce to its Known Exploited Vulnerabilities (KEV) catalog, citing clear evidence of active exploitation. These flaws, tracked as CVE-2026-5430 and CVE-2026-71362, carry CVSS scores of 9.8 and 9.1 respectively, and pose severe risks to enterprises relying on these platforms for API management and e-commerce operations.  CVE-2026-5430 is a path traversal vulnerability impacting WSO2 API Control Plane, API Manager, Traffic Manager, and Universal Gateway. It enables unauthenticated attackers to upload arbitrary files and achieve remote code execution without user interaction. Security firm watchTowr reported observing in-the-wild exploitation since at least September 13, 2026, including forged JWT tokens targeting the flaw. Yordan Ganchev, a principal threat intelligence specialist at watchTowr, emphasized that WSO2 serves nearly 1,000 customers across banking, government, telecom, and logistics—sectors that cannot afford delayed patching.  The second flaw, CVE-2026-71362, affects Adobe Commerce and Magento through an incorrect authorization bug that allows attackers to hijack customer sessions and switch accounts without interaction. This grants unauthorized access to private customer data and sensitive resources. Dutch e-commerce security company Sansec detected and blocked exploitation attempts in August 2026, while Previdian telemetry recorded a lone Australian IP targeting honeypots on September 10, 2026. Although Adobe has not yet confirmed active exploitation in its advisory, the evidence strongly suggests coordinated abuse of this vulnerability.  CISA’s inclusion of both flaws in the KEV catalog triggers mandatory remediation timelines for Federal Civilian Executive Branch (FCEB) agencies, which must apply patches by September 27, 2026. This deadline underscores the urgency for all organizations using WSO2 or Adobe Commerce to prioritize updates immediately. With threat actors already weaponizing these vulnerabilities, waiting for formal advisories or public proof-of-concept code could leave networks exposed to data theft, account takeover, and full system compromise.  Organizations should audit their deployments of WSO2 and Adobe Commerce without delay, ensuring all systems are patched to the latest secure versions. For WSO2, this means updating API Manager and related components to close the path traversal vector. Adobe Commerce and Magento users must apply authorization fixes to prevent session hijacking. Given the high CVSS scores, broad industry usage, and confirmed exploitation, treating these vulnerabilities as critical priorities is essential to safeguarding digital infrastructure and customer data from escalating cyber threats.

CISA says attackers are actively exploiting critical flaws in WSO2 and Adobe Commerce, along with additional issues in Microsoft SharePoint and Mikrotik RouterOS. Federal agencies must patch the critical KEV entries by September 27, while SharePoint and RouterOS fixes are due by September 28. #WSO2 #AdobeCommerce #MicrosoftSharePoint #MikrotikRouterOS #CVE-2026-5430 #CVE-2026-71362 #CVE-2026-65660 #CVE-2026-67279

CISA has added two critical vulnerabilities, CVE-2026-5430 in WSO2 products and CVE-2026-71362 in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation. The flaws can enable remote code execution or unauthorized access to sensitive customer data, and FCEB agencies must patch them by September 27,...

TL;DR On September 24, 2026, CISA updated its Known Exploited Vulnerabilities catalog with two high-risk security flaws. These critical CISA KEV vulnerabilities impact enterprise deployments of WSO2 and Adobe Commerce. Federal agencies and corporate administrators must remediate these flaws immediately to prevent network compromise. Why It Matters Sourced estimates show that tens of thousands of organizations deploy WSO2 middleware and Adobe Commerce storefronts globally.