# CISA Adds Adobe Commerce and Google Brotli Bugs to High‑Risk List, Sets 10 November Patch Deadline

*Wednesday, October 28, 2026 at 6:10 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-10-28T06:10:11.675Z (28h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/21741.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: U.S. cyber authorities have put actively exploited flaws in Adobe Commerce/Magento and Google’s Brotli compression code on their Known Exploited Vulnerabilities list, giving federal agencies until 10 November to patch.

Two widely used pieces of web software have been added to the U.S. government’s list of vulnerabilities that demand urgent fixes. On 28 October, the Cybersecurity and Infrastructure Security Agency (CISA) announced that flaws in Adobe Commerce/Magento and in Google’s Brotli compression library are now in its Known Exploited Vulnerabilities catalog, meaning federal agencies must address them by 10 November.

Security researchers say criminals have already been abusing the Adobe Commerce weakness in what they call the “PolyShell” campaign. In that activity, attackers broke into hundreds of online shops built on Adobe’s platform and injected malicious loaders into the sites’ code. Those additions can quietly skim customer data, redirect buyers to fraudulent pages or install backdoors for later use.

The vulnerability involving Google’s Brotli compression technology has attracted attackers seeking remote code execution, a class of bug that lets them run their own commands on a target system. Researchers have observed “Node2Shell” attempts in the wild, showing that adversaries are actively trying to turn this flaw into a reliable way to take control of servers that rely on Brotli.

By placing both issues in the Known Exploited Vulnerabilities catalog, CISA is signalling that they’re not just serious on paper—they’re being used against real targets. For U.S. civilian agencies, catalog entries come with a clear instruction: find systems that use the affected software and apply patches or mitigations by the federal deadline.

For shoppers and ordinary web users, these attacks can turn up as invisible compromises. A checkout page that looks normal could be quietly sending payment information to an attacker. A server exploited through a Brotli bug might become a launchpad for data theft, ransomware or wider incursions into government and corporate networks.

IT teams running Adobe Commerce or Magento now face the familiar task of checking versions, rolling out vendor fixes and combing through logs for signs of PolyShell‑style injections. Administrators responsible for infrastructure that uses Brotli need to identify where the code is deployed, update or reconfigure affected components and watch for traces of Node2Shell exploitation.

The episode highlights how basic building blocks of the web—from e‑commerce platforms to compression libraries that make sites load faster—remain attractive entry points for attackers. Because these tools are embedded across many services, a single unpatched flaw can ripple outward to many organisations.

In the coming weeks, useful signals will include whether payment firms or browser makers issue their own warnings, how quickly Adobe and projects that use Brotli update their guidance, and whether law enforcement links PolyShell and Node2Shell to specific criminal crews or state‑aligned groups. Any sign that ransomware operators or data‑theft rings are chaining these bugs with other exploits will raise the cost of delay for organisations that have yet to patch.