CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct 27, "based on evidence of active exploitation". Both have a federal due date of Nov 10. Ransomware use is listed as unknown, and neither carries CISA's forensic-triage flag. CISA does not say whose exploitation evidence it relied on.

• CVE-2026-48356, Adobe Commerce and Magento Open Source ("PolyShell"): an unauthenticated file upload through the REST API cart-item custom options (CWE-434). Adobe rates it critical, CVSS 9.6, and fixed it in APSB26-73 (July 14): the 2.4.9, 2.4.8, 2.4.7, 2.4.6 (and Commerce 2.4.5, 2.4.4) "-2026-jul" security releases. Adobe's bulletin still says it is not aware of exploits. Sansec, which named the bug, has reported mass exploitation since March 19, 2026, before production versions had a patch. Uploaded polyglot image/PHP files land in pub/media/custom_options/quote/, and whether they run depends on the web server configuration. Sansec also ties the 953-store cms_block skimmer campaign to it.
• CVE-2026-111497, Google Brotli decoder: the unchecked-return-value bug that becomes an out-of-bounds write (CWE-252/787) behind Node2Shell. It is in every program that bundles a vulnerable Brotli decoder, including Node.js, .NET, Bun, Envoy, Python Brotli bindings and PHP on Windows. Fixed upstream in Brotli 1.2.1, 1.1.1 and 1.0.10, and in Node.js 22.23.4, 24.22.1 and 26.12.1. The day before the listing, ELLIO reported the first in-the-wild exploit request against Node.js 24.22.0 (see our hunt notes).

What to do: Magento and Adobe Commerce stores still without the July security release should patch now, then check pub/media/custom_options/ for PHP or polyglot files, look for rogue admin accounts and audit cms_block. Patching alone does not remove a webshell that is already there. For Brotli, patch Node.js and anything else that decodes untrusted Brotli (see earlier coverage of .NET, FFmpeg, ClickHouse and Arrow and PAN-OS), and rebuild container images that pin old Node.js versions.