CISA adds exploited Brotli and Adobe Commerce flaws to KEV
Federal agencies must fix CVE-2026-111497 and CVE-2026-48356 by October 29, 2026, after reported exploit traffic and store infections.
86
- Mentions · 7d11
- Mentions · 30d16
- All mentions29
- First seenAug 15, 2026
- Last mentioned2d ago
Timeline
29 articles · newest firstCISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
86
Attackers hijack Convertr analytics script to skim checkout card data
Sansec says a Brazilian gang altered Convertr’s Plausible tracker; the skimmer was later removed and Plausible upgraded to a patched version.
74
Attackers infect 953 Magento stores with scanner-evading JavaScript
Sansec says the campaign, active since July 2025, has used five loader domains and the final payload is still unknown.
72
Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
72
Magecart-style script hits 953 Magento stores, Sansec says
The loader hides from scanners, and earlier waves used PolyShell and SessionReaper to plant webshells.
76
Magento skimmer campaign hits 953 stores across five domains
Sansec says deepveindrilling.com, registered October 6, was loaded by 83 mostly Magento stores from October 7.
72
Sansec: 953 online stores, mostly Magento, hit by scanner-evading JavaScript
Loaders in Magento CMS blocks fetch follow-on code only for real shoppers; the final payload is still unknown.
72
953 online stores infected with Magento JavaScript loaders since July 2025
Sansec says loaders on five domains fingerprint visitors and have not yielded a captured final payload.
74
Public PHP2Shell scripts drive mass scans of internet-facing PHP
Fastly saw about 250,000 probe requests from roughly 3,200 IPs, but those counts do not prove servers were compromised.
74
Magecart skimmer hits Convertr checkouts through Plausible tracker
Sansec says the tracker was still serving the skimmer on October 26 and that card data plus CPF was posted to 1x0.is.
76
deepveindrilling.com Magento loader found on 83 stores
Sixty of those stores already carried an earlier loader, and a stored payload reruns after the domain is blocked.
74
PHP patches two critical unauthenticated RCE flaws after exploit leak
A public PoC dubbed PHP2Shell targets PHP 5 through 8; backports exist for 7.4, 8.0, and 8.1, but attacks are not confirmed.
84
Leaked PHP2Shell flaws may allow unauthenticated remote code execution
CVE-2026-109618 and CVE-2026-109619 both score 9.2; WatchTowr and Huntress report no exploitation yet.
80
Critical BlockStrap flaw lets hackers run code on Magento servers
Sansec warns CVE-2026-103849 can run arbitrary PHP on unpatched Magento and Adobe Commerce servers.
66
Blockstrap: Magento and Adobe Commerce RCE (CVE-2026-103849)
Sansec warns of unauthenticated Magento and Adobe Commerce RCE CVE-2026-103849, with no live exploitation seen yet.
78
CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
CISA says attackers are exploiting critical WSO2 and Adobe Commerce flaws plus SharePoint and MikroTik bugs.
84
U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog
CISA added exploited WSO2 and Adobe Commerce flaws to the KEV catalog, with federal fixes due September 27.
82
Brevo Supply Chain Attack Injects Malware Into 100,000 Websites
Attackers breached Brevo, hijacked a Cloudflare API key, and injected ClickFix malware scripts served to visitors of 100,000+ websites including Trezor.
78
Brevo Supply Chain Attack Pushes WordPress Backdoors and ClickFix Malware to 100,000+ Sites
A Brevo supply chain compromise served malicious JavaScript to 100,000+ sites, installing WordPress backdoors and pushing ClickFix commands to visitors.
74
Hackers Turn Brevo Widgets Into Malware Delivery Channel Across 100,000+ Websites
Attackers compromised Brevo-hosted JavaScript to deliver a WordPress backdoor and ClickFix payloads across 100,000+ websites, exposing visitors and admins.
82
Top 10 Best Ransomware Protection Solutions in 2026
A 2026 buyer's guide ranks ten ransomware protection tools by kill-chain role as extortion shifts from encryption to data theft.
15
U.S. CISA adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog
CISA added four actively exploited flaws to its KEV catalog: Magento StyleSmuggler RCE, two Windows privilege-escalation bugs, and N-able N-central RCE.
80
Amasty patches dozens of Magento extensions, 2 critical
Amasty patched dozens of Magento/Adobe Commerce extensions, including two critical flaws allowing unauthenticated web shell upload and remote code execution.
75
StyleSmuggler: The Magento Zero-Day Behind New Store Attacks
Sansec reports actively exploited Magento/Adobe Commerce zero-day StyleSmuggler enabling unauthenticated RCE and Rust backdoor installation on fully patched stores since September 4.
85
Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
StyleSmuggler zero-day in Magento and Adobe Commerce is actively exploited in the wild to deploy a Rust-based Linux backdoor; fix not yet released.
78
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.
85
StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack
Sansec details actively exploited StyleSmuggler 0-day (CVE-2026-75650, CVSS 10.0) unauthenticated RCE in Magento and Adobe Commerce, patched by Adobe hotfix APSB26-146.
88
Adobe Patches Three CVSS 10.0 ColdFusion and Campaign Classic Flaws
Adobe patches seven flaws in ColdFusion, Commerce, and Campaign Classic, including actively exploited CVE-2026-71362 enabling customer account takeover.
75
Related CVEs
by mentions- CVE-2026-4835645%9.3Unrestricted dangerous file upload in Adobe Commerce and Magento
- CVE-2025-5423695%9.1Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper)
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-756504%10.0Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650)
- CVE-2026-7136290%9.1Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento)
- CVE-2026-543022%10.0Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-1038491%10.0Unauthenticated template-injection RCE in Adobe Commerce
- CVE-2026-8467<1%9.5Code Injection vulnerability in phenixdigital phoenix_storybook allows unauthenticated remote code execution via unsanitized attribute value interpolation in…
Appears with
- Adobevendor · 18
- Adobe Commerceproduct · 13
- Magentoproduct · 13
- Sansecvendor · 9
- Magento Open Sourceproduct · 8
- CISAorganization · 6
- Adobeorganization · 6
- PHPproduct · 4
- GSocketmalware · 4
- Microsoftvendor · 4
- PolyShellmalware · 4
- WordPressproduct · 3
- Cloudflarevendor · 3
- Brevovendor · 3
- StyleSmugglermalware · 3
- Brevoorganization · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.