Briefing · Wednesday 28 October 2026 · 07:00 UTC
CISA adds exploited Brotli and Magento flaws to KEV
By CyberSIXT Briefing · from 93 reports by 17 outlets · Editorial policy
CISA’s Known Exploited Vulnerabilities catalogue lists CVE-2026-111497 in Google Brotli and CVE-2026-48356 in Adobe Commerce and Magento, both added on 27 October 2026.CISAThe Hacker News After Tuesday’s edition centred on two PHP flaws, the new entries widen the focus to a compression component used across products and an e-commerce platform; CISA confirms active exploitation for Brotli, while the available data lists ransomware use as unknown.CISAThe Hacker News The other major development is reporting that ShinyHunters exploited a PeopleSoft flaw before Oracle’s June patch, with researchers describing a chain of three vulnerabilities tracked under one CVE.The Hacker News
CISA adds Brotli and Magento flaws to its KEV catalogue#
CISA’s catalogue lists CVE-2026-111497, named the Google Brotli Unchecked Return Value Vulnerability, and CVE-2026-48356, an unrestricted file upload flaw affecting Adobe Commerce and Magento, as added on 27 October 2026.CISAThe Hacker News CISA says exploitation of the Brotli flaw is active and that the vulnerability can be triggered remotely with a crafted Brotli-compressed stream; the catalogue data lists ransomware use as unknown.CISA
The Hacker News reported Sansec’s warning that attackers used CVE-2026-48356 to breach hundreds of online stores, while CISA’s listed remediation deadline for affected federal agencies is 10 November 2026.The Hacker News SecurityOnline said Adobe patches cover Commerce 2.4.9 and earlier supported releases and Magento Open Source 2.4.9 and earlier, while Brotli fixes include versions 1.0.10, 1.1.1 and 1.2.1.SecurityOnline
AnalysisThe available sources establish active exploitation for Brotli and report store compromises involving Magento, but do not quantify confirmed Magento victims beyond The Hacker News’s account of Sansec’s warning.CISAThe Hacker News
ShinyHunters exploited Oracle PeopleSoft before its June patch#
The Hacker News reported that ShinyHunters exploited Oracle PeopleSoft’s CVE-2026-35273 before Oracle issued a patch in a June security alert, targeting PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62.The Hacker News Mandiant and Google Threat Intelligence Group attributed an early wave, running from 27 May to 9 June, to UNC6240, also known as ShinyHunters, and reported attacks against universities.The Hacker News
Zero Day Initiative researchers described three chained flaws across two PeopleSoft components, with the server-side request forgery enabling access to an internal management interface and a route to remote code execution.thezdi.comThe Hacker News The Hacker News said a September follow-up extended the reported campaign beyond education to technology, IT services, healthcare and government, affecting dozens of systems worldwide; ZDI said separate CVEs for two flaws may be assigned when finalised.The Hacker News
eMudhra certificate exposure prompts revocation and system updates#
SANS ISC reported on 28 October that private keys behind several eMudhra signing certificates had been exposed, prompting revocation efforts across multiple ecosystems.SANS ISC SANS ISC said Microsoft issued an out-of-band patch for Windows 10 and 11 and macOS released an operating system update, while command-line utilities may remain vulnerable where the certificate is still present in /etc/ssl/cert[.]pem.SANS ISC
The update covers Safari and most browsers and email clients, SANS ISC said, but Homebrew users may have an additional certificate store and Linux systems may hold multiple CA files.SANS ISC
Tailscale releases version 1.104.4 to fix SSH flaws#
Tailscale released version 1.104.4 to address four advisories involving its built-in SSH server, tailscale serve and TLS serve, The Hacker News reported on 28 October.The Hacker News The flaws could expose root-only services and files, exhaust server memory or leak permission headers; exploitation of the SSH forwarding issues requires control of a device permitted by network access rules to open a forwarded SSH session to the target.The Hacker News
Cyberdione Labs researcher Erica Windisch found that forwarding to the Docker control socket produced a root shell in testing, while Tailscale disputed her description of the chain as “wormable” and said movement is limited to policy-permitted connections.The Hacker News
Also
- Linux kernel. Google’s kernelCTF programme published a working proof-of-concept for CVE-2026-23111, a Linux Netfilter nf_tables use-after-free with patched kernels available since February 2026, SecurityOnline reported.SecurityOnline
- Gen Digital. Gen Digital researchers found a campaign using fake Claude sharing pages and Google Ads to distribute an Atomic macOS Stealer and a Windows remote access trojan, without compromising Anthropic’s infrastructure, SecurityOnline reported.SecurityOnline
- Interpol. Dark Reading reported that Operation Serengeti III resulted in about 1,462 arrests across 20 African countries and the United States, with roughly $105 million in stolen funds recovered and nearly 11,000 malicious networks shut down.Dark Reading
- WatchGuard. WatchGuard issued 18 Fireware OS advisories on 27 October, including CVE-2026-103594, rated 9.5, and said none of the flaws had been publicly exploited to date.SecurityOnline
- Supermicro. Supermicro disclosed eight BMC vulnerabilities affecting 392 motherboard and module SKUs, including an unauthenticated IPMI flaw rated CVSSv3 9.8, and said fixed firmware was available for most boards.SecurityOnline
Watching
CISA set 10 November 2026 as the remediation deadline for affected federal agencies covering the newly listed vulnerabilities.CISAThe Hacker News