Security news.
Active exploitation headlines today's brief, as CISA adds flaws in Google Brotli and Adobe Commerce to its Known Exploited Vulnerabilities catalog while threat actors probe unpatched Oracle E-Business Suite instances. Concurrently, state-backed actors are leveraging recent PHP vulnerabilities to compromise network edge devices, and critical infrastructure control software faces major patching requirements.
CISA Adds Critical Node2Shell Brotli Flaw to KEV Catalog
CISA confirmed in-the-wild exploitation of a critical Google Brotli decoder flaw (CVE-2026-111497) as honeypots detect active attack attempts targeting web environments.
Hackers Actively Scanning for Oracle E-Business Suite Flaw
Threat actors have begun mass scanning for systems vulnerable to CVE-2026-101767, an unauthenticated SQL injection vulnerability that allows remote code execution on Oracle EBS deployments.
China-Linked Hackers Root Firewalls via PHP2Shell Exploits
Attackers chained the recently disclosed PHP2Shell flaws (CVE-2026-109618, CVE-2026-109619) with Fragnesia to breach and gain root access to servers at a US government-affiliated organization.
Adobe Commerce PolyShell Attacks Compromise Hundreds of Stores
In-the-wild campaigns are actively exploiting an unrestricted file upload vulnerability (CVE-2026-48356, CVSS 9.2) in Adobe Commerce and Magento, prompting an immediate CISA KEV listing.
Tailscale Patches SSH Flaws Allowing Root Escalation Across Servers
Tailscale rushed out version 1.104.4 following public disclosure of vulnerabilities in its built-in SSH connection forwarding that could let an attacker gain unauthorized root privileges on other systems.
Adobe Fixes Eight Critical Flaws in Campaign Classic
Adobe addressed multiple critical bugs, including CVE-2026-104351 (CVSS 9.9), an arbitrary code injection flaw that also allows privilege escalation and security feature bypasses.
EPICS Research Facility Control Software Patches Long-Hidden Flaws
Four vulnerabilities (CVSS 9.8) discovered in EPICS Base releases <=7.0.10 could allow attackers to execute arbitrary code or crash industrial control processes at particle accelerators and fusion research facilities.