CISA adds exploited Brotli and Adobe Commerce flaws to KEV
Federal agencies must fix CVE-2026-111497 and CVE-2026-48356 by October 29, 2026, after reported exploit traffic and store infections.
86
Product
Magento
- Mentions · 7d11
- Mentions · 30d21
- All mentions32
- First seenSep 5, 2026
- Last mentioned2d ago
Timeline
32 articles · newest firstCISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
86
Attackers hijack Convertr analytics script to skim checkout card data
Sansec says a Brazilian gang altered Convertr’s Plausible tracker; the skimmer was later removed and Plausible upgraded to a patched version.
74
Attackers infect 953 Magento stores with scanner-evading JavaScript
Sansec says the campaign, active since July 2025, has used five loader domains and the final payload is still unknown.
72
CISA adds Adobe Commerce and Google Brotli flaws to KEV
CVE-2026-48356 is an unrestricted upload flaw; CVE-2026-111497 is an unchecked return value bug in Brotli.
76
Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
72
Magecart-style script hits 953 Magento stores, Sansec says
The loader hides from scanners, and earlier waves used PolyShell and SessionReaper to plant webshells.
76
CISA adds exploited Adobe Commerce and Magento upload flaw to KEV
CVE-2026-48356 can run code as the current user; federal agencies must mitigate by November 10.
78
Magento skimmer campaign hits 953 stores across five domains
Sansec says deepveindrilling.com, registered October 6, was loaded by 83 mostly Magento stores from October 7.
72
Sansec: 953 online stores, mostly Magento, hit by scanner-evading JavaScript
Loaders in Magento CMS blocks fetch follow-on code only for real shoppers; the final payload is still unknown.
72
953 online stores infected with Magento JavaScript loaders since July 2025
Sansec says loaders on five domains fingerprint visitors and have not yielded a captured final payload.
74
deepveindrilling.com Magento loader found on 83 stores
Sixty of those stores already carried an earlier loader, and a stored payload reruns after the domain is blocked.
74
Searchlight releases php2shell-scanner for two PHP RCE bugs
The open-source scanner forces a PHP out-of-memory condition instead of trusting version banners.
62
PHP2Shell flaws draw early attacks; emergency PHP updates out
Fixes are in PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35; both bugs are rated 9.2.
92
Talos tracks two unauthenticated PHP core RCEs called php2shell
Talos had not seen exploitation as of October 21 and says about half of PHP systems may never be patched.
84
PHP releases emergency fixes for two critical unauthenticated RCEs
Exploits are public, and Finnish and Dutch sites went offline while watchTowr says attempts have not succeeded.
86
Critical PHP remote code execution flaw already under attack
Patchstack says the only current fix is upgrading PHP, with an update scheduled for October 21 at 14:00 UTC.
90
PHP to fix two critical RCEs, CVE-2026-109618 and CVE-2026-109619
The official fix is due October 21 at 14:00 UTC; PHP 8.1 and older will not get one.
82
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
Attackers are actively exploiting critical unauthenticated NetScaler RCE CVE-2026-88771, now listed in CISA's KEV catalog.
86
CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks
CyberXero used Claude Code, PentAGI and Cobalt Strike to breach sites and steal Ukrainian data.
82
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero used WordPress exploits and Claude agents against Ukrainian energy targets, stealing hundreds of thousands of records.
84
CISA warns of Sharepoint, WSO2, Adobe Commerce flaws exploited in attacks
CISA says attackers are exploiting critical WSO2 and Adobe Commerce flaws plus SharePoint and MikroTik bugs.
84
AI-Powered Campaign Targets Hundreds of Online Retailers
A Chinese-speaking actor used autonomous AI agents to compromise online retailers and steal over 600,000 credit cards.
86
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited WSO2 and Adobe Commerce flaws to the Known Exploited Vulnerabilities catalog.
78
Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
An AI-agent campaign stole over 600,000 cards and skimmer-infected at least 119 retail sites.
85
Microsoft breaks Patch Tuesday record with 974-CVE deluge
Microsoft's record 974-CVE Patch Tuesday ships two exploited Windows zero-days, while Adobe's StyleSmuggler zero-day (CVE-2026-75650) gives unauthenticated RCE in Magento.
90
Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day
Adobe patched over 170 flaws, including in-the-wild zero-day CVE-2026-75650 (CVSS 10) in Adobe Commerce/Magento enabling unauthenticated RCE and web shell deployments.
88
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA added four actively exploited vulnerabilities to its KEV catalog, covering Adobe Commerce/Magento, Microsoft Windows, and N-able N-central.
72
Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
StyleSmuggler zero-day in Magento and Adobe Commerce is actively exploited in the wild to deploy a Rust-based Linux backdoor; fix not yet released.
78
⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More
Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.
72
Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Sansec found attackers exploiting an Adobe Commerce/Magento zero-day (StyleSmuggler) since September 4 to deploy Rust backdoors on online stores.
82
Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.
85
Related CVEs
by mentions- CVE-2026-4835645%9.3Unrestricted dangerous file upload in Adobe Commerce and Magento
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2025-5423695%9.1Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper)
- CVE-2026-756504%10.0Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650)
- CVE-2026-11149783%9.2Buffer overflow in Google Brotli decoder 1.0.3–1.2.0
- CVE-2026-543022%10.0Unauthenticated JWT Algorithm Bypass in WSO2 API Manager and Gateways
- CVE-2026-7136290%9.1Unauthenticated Privilege Escalation Flaw in Adobe Commerce (Magento)
- CVE-2026-81963<1%7.8Local Privilege Escalation via Link Following in Windows Update Stack
- CVE-2026-4815<1%8.7A SQL Injection vulnerability has been found in Support Board v3.7.7
Appears with
- Adobevendor · 20
- Adobe Commerceproduct · 15
- Sansecorganization · 13
- CISAorganization · 8
- PHPproduct · 7
- WordPressproduct · 7
- Sansecvendor · 6
- Googlevendor · 5
- Drupalproduct · 5
- GSocketmalware · 4
- PolyShellmalware · 4
- CERT-EUorganization · 4
- Microsoftvendor · 4
- Joomlaproduct · 4
- WooCommerceproduct · 3
- watchTowrorganization · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.