Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

AI Summary

CISA added three vulnerabilities to its KEV catalog: CVE-2026-111497 (CVSS 9.2) in Adobe Commerce/Magento via a PolyShell attack campaign breaching hundreds of e-commerce stores, and a critical flaw in Google's Brotli decoder library (the Node2Shell/HTTP2Shell vector) with confirmed active exploitation observed by honeypot operators. Organizations running Adobe Commerce or Magento storefronts and systems using the Brotli library face immediate patching urgency.

Read full article → https://thehackernews.com/2026/10/adobe-commerce-p…

Relevance score: 85.0/100

# More from October 29

1
Volt Typhoon Used Covert Silent Train Network in Four Zero-Day Exploitation Campaigns The Hacker News
2
Researcher Reveals How Logic Bugs Alone Cracked Microsoft Edge in $175,000 Pwn2Own Win The Hacker News
4
ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws The Hacker News
5
Hackers Target Critical Oracle E-Business Suite RCE Flaw Days After Security Patch The Hacker News
6
Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers The Hacker News
7
PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network The Hacker News
8
Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass The Hacker News
9
Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers The Hacker News
10
Chrome and Firefox Updates Patch Over 200 Vulnerabilities SecurityWeek