Overview
- CISA added the two high‑severity vulnerabilities to its Known Exploited Vulnerabilities catalog on Tuesday, directing federal civilian agencies to apply fixes within set deadlines reported by vendors and outlets.
- The Brotli flaw tracked as CVE‑2026‑111497 is an unchecked return/out‑of‑bounds bug in Google’s Brotli decoder that can corrupt decoder memory, expose sensitive process memory, cause crashes, and in some configurations allow remote code execution when an application decompresses attacker‑controlled Brotli streams.
- The Adobe Commerce/Magento flaw CVE‑2026‑48356, dubbed PolyShell, is an unrestricted file upload vulnerability that attackers have used to inject a loader into CMS blocks and thereby fetch and run attacker‑controlled payloads on at least 953 stores according to Sansec.
- Multiple honeypots and sensor networks recorded exploitation attempts on Oct. 26–27 and public proof‑of‑concept tooling has demonstrated code execution against certain Node.js builds, with telemetry linking some activity to an operator IP previously seen in mass‑scan campaigns.
- Vendors including Node.js, Google, Microsoft, PHP maintainers and others have released patches and advisories, and defenders are urged to update affected packages, rebuild and redeploy containers and serverless images, restart processes, or temporarily block Brotli decoding at the proxy to reduce risk.