Good morning. Two KEV additions landed yesterday, and both already had fixes waiting. That is the theme today: the patch is not the news, the unpatched install is.
1. PolyShell now in CISA KEV: Adobe Commerce and Magento file upload flaw, federal due date November 10 (CVE-2026-48356). CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 27, with a federal patch deadline of November 10. Adobe fixed it in July in APSB26-73, yet Sansec reports exploitation since March 2026 and a loader campaign on 953 online stores, with 471 injected through PolyShell. Confirm a 2026-jul build, then hunt uploads disguised as images in pub/media/custom_options/quote/, unexpected CMS blocks and pages, and rogue admin accounts, because patching does not remove anything already planted.
2. Brotli decoder flaw now in CISA KEV: update the library and everything that bundles it (CVE-2026-111497). CISA added the Google Brotli flaw to KEV on October 27, also due November 10. A remote unauthenticated attacker can use a crafted Brotli-compressed stream to corrupt decoder memory, disclose memory, cause a denial of service, or potentially execute code. Update Brotli to v1.2.1 and apply downstream Node.js, .NET, and PHP updates, starting with anything that decompresses untrusted data from the internet.
3. Apple iOS and macOS 27.2 patch 286 bugs. Apple released iOS and iPadOS 27.2 fixing 163 flaws and macOS Golden Gate 27.2 fixing 263 flaws, about 140 shared. The fixes cover WebKit and kernel memory corruption, sandbox escapes, privilege escalation, Gatekeeper bypasses, and remotely reachable flaws in Screen Sharing, Remote Management, and SMB. This is the current-device release, separate from yesterday's iOS 18.7.11 backport for older devices, so update current iPhones, iPads, and Macs now.
4. Fake IT desk in Microsoft Teams: 400 incidents, payload in under 15 minutes. Arctic Wolf examined more than 400 incidents in which attackers used Teams external chat, on by default, to pose as IT support, often after flooding the inbox with newsletter confirmations and then offering to fix the noise. Once the victim engaged, attackers reached payload execution in under 15 minutes, often with Quick Assist or AnyDesk. Arctic Wolf did not attribute these 400 incidents to a named group. Restrict external Teams access, verify any IT contact through a known channel, and treat an unsolicited external IT chat as an incident, not a help offer.
Reminder: the PHP2Shell federal patch deadline is tomorrow, October 29. If PHP is still unpatched, today is the day.
Full writeups: kevinthecyberguy.com/vuln-watch
Indicators to hunt: kevinthecyberguy.com/ioc-library
New CISA KEV additions today: CVE-2026-48356, Adobe Commerce and Magento PolyShell, and CVE-2026-111497, Google Brotli, federal due date November 10, 2026.
Principal Cybersecurity Engineer with 17+ years across banking, payments, and consulting. Writing about AI security, identity, and the fundamentals that stop most incidents. kevintswaney.com