Ethical Hacking News
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the need for organizations to stay up-to-date with the latest security patches. Google's Brotli library and Adobe Commerce and Magento are now listed as vulnerable, with experts warning of potential exploitation attempts and a 91% of cloud environments containing resources vulnerable to the flaws.
Two new vulnerabilities have been added to the Known Exploited Vulnerabilities (KEV) catalog by CISA. CVE-2026-111497 is a critical flaw in Google's Brotli library, allowing remote attacks and code execution. CVE-2026-48356 is an unrestricted file upload vulnerability in Adobe Commerce and Magento, allowing arbitrary code execution. 91% of cloud environments and 82% of Node.js instances are vulnerable to CVE-2026-111497. The PolyShell vulnerability is believed to have started in July 2025 and remains ongoing, with unknown objectives. Experts recommend reviewing the catalog and addressing the vulnerabilities, with federal agencies ordered to fix by October 29, 2026.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has taken the necessary steps to add two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. The first vulnerability, identified as CVE-2026-111497, is a critical flaw in Google's Brotli library that can allow a remote, unauthenticated attacker to corrupt decoder memory, expose sensitive information, cause a denial-of-service, or potentially execute arbitrary code by sending a specially crafted Brotli-compressed stream.
According to CISA, the second vulnerability, tracked as CVE-2026-48356, is an unrestricted file upload vulnerability in Adobe Commerce and Magento that can allow an attacker to execute arbitrary code with the privileges of the current user, potentially gaining elevated access or taking control of the victim's account or session.
Security researchers have observed exploitation attempts targeting CVE-2026-111497, a flaw in Google's Brotli library, and have warned that 91% of cloud environments contain resources vulnerable to this flaw, while 82% have publicly exposed Node.js instances. Cybersecurity firm Wiz has also noted that the activity may indicate attempts to exploit the flaw on a larger scale, but its scope remains unclear.
Similarly, the second flaw, dubbed PolyShell, is believed to have been underway since at least July 2025 and remains ongoing. Researchers have not recovered the subsequent payload, leaving the campaign's ultimate objectives unclear.
Experts recommend that private organizations review the catalog and address the vulnerabilities in their infrastructure. CISA orders federal agencies to fix the flaws by October 29, 2026.
The discovery of these vulnerabilities highlights the importance of keeping software up-to-date and patched, as well as the need for organizations to stay vigilant in protecting themselves against cyber threats.
Related Information:
https://www.ethicalhackingnews.com/articles/US-CISA-Adds-Google-Brotli-and-Adobe-Commerce-and-Magento-Flaws-to-Known-Exploited-Vulnerabilities-Catalog-ehn.shtml
https://securityaffairs.com/201922/security/u-s-cisa-adds-google-brotli-and-adobe-commerce-and-magento-flaws-to-its-known-exploited-vulnerabilities-catalog.html
https://nvd.nist.gov/vuln/detail/CVE-2026-111497
https://www.cvedetails.com/cve/CVE-2026-111497/
https://nvd.nist.gov/vuln/detail/CVE-2026-48356
https://www.cvedetails.com/cve/CVE-2026-48356/
Published: Wed Oct 28 08:08:28 2026 by llama3.2 3B Q4_K_M
