Skip to content
OriginalSign in

The Hacker Newsinfo@thehackernews.com (The Hacker News)

CISA Adds Two Actively Exploited Flaws to KEV Catalog

Part of the CVE-2026-111497 story · since 21 Oct

Developinglatest 7 minutes ago19 articles7 outlets
21 Oct · SecurityOnline first25 Oct26 Oct27 OctNowThis article18th of 19
  • Wed 21 Oct, 17:54 UTC. SecurityOnline, first report. Node.js fixes Brotli flaw that could enable remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:35 UTC. The Hacker News, its first report on the story. Node.js Brotli flaw enables remote code execution in Linux arm64 builds. Cites a CVE in CISA KEV.
  • Sat 24 Oct, 11:00 UTC. The Hacker News. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 08:30 UTC. The Hacker News. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. Brotli flaw expands Node2Shell risk across HTTP applications. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:19 UTC. SecurityOnline. Microsoft issues out of band .NET fixes for four flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Brotli flaw triggers security updates across major software. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:00 UTC. SOCRadar, its first report on the story. Brotli flaw exposes Python packages to remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:30 UTC. Infosecurity, its first report on the story. Microsoft patches critical .NET flaw that risks memory corruption. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 18:30 UTC. The Hacker News. PHP releases rebuilt Windows packages to fix Brotli flaw. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 19:00 UTC. Rapid7, its first report on the story. Node.js Brotli flaw could expose memory or enable remote code execution. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 02:00 UTC. SecurityOnline. Palo Alto confirms critical Brotli flaw affects PAN-OS. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds exploited Google Brotli flaw to KEV catalogue. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 23:00 UTC. SecurityOnline. Sweet Security offers free protection against HTTP2Shell. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 01:00 UTC. SecurityOnline. CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 08:00 UTC. SecurityOnline. Broadcom warns of critical VMware SDDC Manager flaw. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 08:01 UTC. The Hacker News. CISA Adds Two Actively Exploited Flaws to KEV Catalog. Cites a CVE in CISA KEV. This article, 18th of 19.
  • Wed 28 Oct, 09:30 UTC. SecurityWeek. Researchers report exploitation attempts against Brotli flaw. Cites a CVE in CISA KEV.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical flaws affecting Adobe Commerce and Magento, alongside Google's Brotli decoder, to its Known Exploited Vulnerabilities (KEV) catalog, after evidence of active exploitation was observed.

The vulnerabilities cited are CVE-2026-111497, a high‑severity flaw in the Brotli decoder that can corrupt adjacent decoder state memory and potentially lead to denial of service, memory disclosure or remote code execution, and CVE-2026-48356, an unrestricted file upload in Adobe Commerce and Magento that could allow arbitrary code execution in the context of the current user.

The KEV listing follows Sansec’s warning that attackers have been exploiting CVE-2026-48356 (also known as PolyShell) to breach hundreds of online stores by injecting a malicious loader via a Magento CMS block, with the loader designed to fetch and execute an attacker‑controlled payload.

Evidence of exploitation for CVE-2026-111497 includes telemetry from Previdian indicating at least one honeypot exploitation attempt from a US address as of 27 October 2026, while Ellio reported real traffic exploit activity and the public Node2Shell tooling being used in the wild. Rapid7 highlighted that the Node.js Brotli decoder could enable out‑of‑bounds writes, potentially causing crashes or remote code execution depending on application behaviour.

Node.js has addressed the Brotli flaw in versions 22.23.4, 24.22.1, and 26.12.1, with Akamai noting that upgrading is the only complete remediation since the Node.js advisory offers no workaround. Wiz warned that a large majority of cloud resources may be vulnerable to CVE-2026-111497, including many publicly exposed Node.js instances. The advisory states that organisations, including Federal Civilian Executive Branch (FCEB) agencies, have until 10 November 2026 to apply the fixes.

The broader impact is being felt across multiple ecosystems, with patches and mitigations coming from PHP, Node.js, Bun, Envoy, Istio, .NET, Python, and others, as vendors race to curb exploitation and assess affected products.

How the story developed

All 19 articles
Developinglatest 7 minutes ago19 articles7 outlets

19 articles from 7 outlets since 21 Oct. Still developing; the latest report was 7 minutes ago. This was the 18th report, 7 days after the first.

Now21 Oct2324252627First reportSecurityOnline · 21 Oct, 17:54This article18th of 19 · day 7CISA alert27 Oct, 20:01 · official
  • Wed 21 Oct, 17:54 UTC. SecurityOnline, first report. Node.js fixes Brotli flaw that could enable remote code execution. Cites a CVE in CISA KEV.
  • Fri 23 Oct, 08:35 UTC. The Hacker News, its first report on the story. Node.js Brotli flaw enables remote code execution in Linux arm64 builds. Cites a CVE in CISA KEV.
  • Sat 24 Oct, 11:00 UTC. The Hacker News. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds. Cites a CVE in CISA KEV.
  • Sun 25 Oct, 08:30 UTC. The Hacker News. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 01:30 UTC. SecurityOnline. Brotli flaw expands Node2Shell risk across HTTP applications. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 03:19 UTC. SecurityOnline. Microsoft issues out of band .NET fixes for four flaws. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 11:00 UTC. SecurityWeek, its first report on the story. Brotli flaw triggers security updates across major software. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:00 UTC. SOCRadar, its first report on the story. Brotli flaw exposes Python packages to remote code execution. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 13:30 UTC. Infosecurity, its first report on the story. Microsoft patches critical .NET flaw that risks memory corruption. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 15:31 UTC. The Hacker News. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 18:30 UTC. The Hacker News. PHP releases rebuilt Windows packages to fix Brotli flaw. Cites a CVE in CISA KEV.
  • Mon 26 Oct, 19:00 UTC. Rapid7, its first report on the story. Node.js Brotli flaw could expose memory or enable remote code execution. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 02:00 UTC. SecurityOnline. Palo Alto confirms critical Brotli flaw affects PAN-OS. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 20:01 UTC. CISA, its first report on the story. CISA adds exploited Google Brotli flaw to KEV catalogue. Cites a CVE in CISA KEV.
  • Tue 27 Oct, 23:00 UTC. SecurityOnline. Sweet Security offers free protection against HTTP2Shell. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 01:00 UTC. SecurityOnline. CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 08:00 UTC. SecurityOnline. Broadcom warns of critical VMware SDDC Manager flaw. Cites a CVE in CISA KEV.
  • Wed 28 Oct, 08:01 UTC. The Hacker News. CISA Adds Two Actively Exploited Flaws to KEV Catalog. Cites a CVE in CISA KEV. This article, 18th of 19.
  • Wed 28 Oct, 09:30 UTC. SecurityWeek. Researchers report exploitation attempts against Brotli flaw. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 19 articles as a list
  1. Wed 21 OctDay 01
    1. Node.js fixes Brotli flaw that could enable remote code execution17:54 · SecurityOnline · First report · Exploited CVE · Known exploited CVE

  2. Quiet for 2 days

    Fri 23 OctDay 21
    1. Node.js Brotli flaw enables remote code execution in Linux arm64 builds08:35 · The Hacker News · Known exploited CVE
  3. Sat 24 OctDay 31
    1. Brotli Flaw Enables Code Execution in Unpatched Node.js Builds11:00 · The Hacker News · Known exploited CVE
  4. Sun 25 OctDay 41
    1. OpenAI Agents Expose VM Escapes and Sandbox Weaknesses08:30 · The Hacker News · Known exploited CVE
  5. Mon 26 OctDay 58
    1. Brotli flaw expands Node2Shell risk across HTTP applications01:30 · SecurityOnline · Known exploited CVE
    2. Microsoft issues out of band .NET fixes for four flaws03:19 · SecurityOnline · Known exploited CVE
    3. Brotli flaw triggers security updates across major software11:00 · SecurityWeek · Known exploited CVE
    Show 5 more from 26 Oct
    1. Brotli flaw exposes Python packages to remote code execution13:00 · SOCRadar · Known exploited CVE
    2. Microsoft patches critical .NET flaw that risks memory corruption13:30 · Infosecurity · Known exploited CVE
    3. Weekly recap tracks PHP and Node.js RCE flaws and supply chain attacks15:31 · The Hacker News · Known exploited CVE
    4. PHP releases rebuilt Windows packages to fix Brotli flaw18:30 · The Hacker News · Known exploited CVE
    5. Node.js Brotli flaw could expose memory or enable remote code execution19:00 · Rapid7 · Known exploited CVE
  6. Tue 27 OctDay 63
    1. Palo Alto confirms critical Brotli flaw affects PAN-OS02:00 · SecurityOnline · Known exploited CVE
    2. CISA adds exploited Google Brotli flaw to KEV catalogue20:01 · CISA · official · CISA alert · Known exploited CVE
    3. Sweet Security offers free protection against HTTP2Shell23:00 · SecurityOnline · Known exploited CVE
  7. Wed 28 OctDay 74
    1. CISA Adds Adobe Magento and Google Brotli Flaws to KEV Catalog01:00 · SecurityOnline · Known exploited CVE
    2. Broadcom warns of critical VMware SDDC Manager flaw08:00 · SecurityOnline · Known exploited CVE
    3. CISA Adds Two Actively Exploited Flaws to KEV Catalog08:01 · The Hacker News · Known exploited CVE · This article, 18th of 19
    4. Researchers report exploitation attempts against Brotli flaw09:30 · SecurityWeek · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in