New Zero‑Day Chain Hits Oracle, Adobe Commerce, Threatening Retail and Government Systems
Severity: WARNING
Detected: 2026-10-28T06:32:09.686Z
Summary
U.S. CISA and new technical analyses between 05:44 and 06:06 UTC flag actively exploited flaws in Adobe Commerce/Magento, Google’s Brotli library, and a chained Oracle PeopleSoft zero‑day enabling unauthenticated remote code execution. These vulnerabilities sit at the core of global e‑commerce and government ERP stacks, putting payment data, HR records, and financial operations at immediate risk if patching lags.
Details
A cluster of critical software weaknesses disclosed over the past hour has moved from technical concern to systemic risk for commerce and public-sector operations. At 05:44 UTC on 28 October, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added actively exploited flaws in Adobe Commerce/Magento and Google’s Brotli library to its Known Exploited Vulnerabilities (KEV) catalog, imposing a 10 November patch deadline on federal networks. Minutes later, new analysis at 06:06 UTC revealed that the Oracle PeopleSoft zero‑day exploited by the ShinyHunters group was actually a chain of three vulnerabilities culminating in unauthenticated remote code execution, all rolled into CVE-2026-35273.
Confirmed details indicate two distinct but converging threat streams. First, CISA’s KEV update cites “PolyShell” intrusions where attackers breached hundreds of online stores running Adobe Commerce/Magento, injecting malicious loaders into checkout flows, and “Node2Shell” remote code execution exploit attempts against infrastructure using Google’s Brotli compression. These are not theoretical bugs: CISA explicitly labels them as actively exploited in the wild, with U.S. federal agencies ordered to patch by 10 November. Second, security researchers now state that the Oracle PeopleSoft incident attributed to ShinyHunters relied on three chained flaws, beginning with a server-side request forgery (SSRF) to bypass internal access controls and ending in full remote code execution without authentication. All three issues have been patched under a single CVE, but exploitation pre‑patch likely provided deep access to HR, finance, and supply-chain data in affected organizations. Source confidence is high that exploitation is ongoing for the Adobe/Magento and Brotli bugs and was successful in at least some PeopleSoft environments.
The human and industry stakes are concrete. Merchants running Adobe Commerce/Magento handle millions of customer transactions; successful PolyShell‑style compromises can skim card data, inject fraudulent payment flows, or plant ransomware across store backends, hitting consumers directly through fraud and outages. Oracle PeopleSoft is widely used by governments, universities, and large enterprises for payroll, HR, procurement, and financials. Unauthenticated RCE there exposes salary data, personally identifiable information, vendor banking details, and internal budget records. For public administrations and large corporates, sudden system lockdowns or data theft can delay salary runs, purchasing, and benefits payments, with cascading effects on staff and dependent suppliers.
From a security posture perspective, the Oracle chain shows that adversaries are successfully weaponizing complex multi-bug paths against high-value ERP targets, not just edge web apps. Meanwhile, the Adobe and Brotli exploits hit the broader web stack, including content delivery and Node-based services. The combination raises the risk of multi-vector campaigns that can move from a compromised e‑commerce front end into back‑office systems, especially where integration with ERP or payment gateways is tight. ShinyHunters’ involvement suggests financially motivated actors leveraging these vectors for large-scale data theft and extortion rather than purely disruptive aims, but operational fallout can still be significant.
Markets will watch for any disclosure that a major listed retailer, payment processor, or government contractor has been compromised via these paths. E‑commerce and retail equities could face downside on breach news and increased fraud costs, while cybersecurity vendors and managed security service providers may see a bid as incident response activity ramps up. Payment networks and banks may incur higher chargeback and fraud-mitigation expenses if card data theft is widespread. For sovereigns, any disruption to PeopleSoft-based payroll or procurement at scale could trigger domestic political pressure and raise questions about vendor risk management in public contracts.
Key watch points over the next 24–48 hours: (1) Whether any G20 government or globally recognized retailer discloses compromise linked to CVE-2026-35273 or the PolyShell/Node2Shell exploits; (2) updates from Oracle, Adobe, and major cloud providers on the prevalence of vulnerable deployments and any guidance for incident detection; (3) additional CISA or allied CERT advisories that broaden the scope beyond U.S. federal networks; and (4) signs of coordinated ransomware or data extortion campaigns weaponizing these vectors against financial institutions, healthcare, or critical infrastructure operators. Rapid patching and active monitoring of payment flows, ERP activity logs, and anomalous web traffic will be decisive in containing systemic risk.
MARKET IMPACT ASSESSMENT: If exploitation scales, expect pressure on retail/e‑commerce equities, payment processors, and cloud/security names, with bid for cybersecurity stocks. Any public breach at a major merchant or government ERP operator could widen to consumer confidence and card networks.
Sources
- OSINT