🚨 ACTIVE EXPLOITATION
- CISA adds exploited Adobe Commerce file-upload flaw CVE-2026-48356 to KEV catalog
CVE-2026-48356
CISA has added CVE-2026-48356, a critical unrestricted file upload flaw in Adobe Commerce and Magento, to its KEV catalog with a due date of 2026-11-10.- Affects Adobe Commerce 2.4.4–2.4.9, Adobe Commerce B2B 1.3.3–1.5.3, Magento Open Source 2.4.6–2.4.9, and Adobe I/O Events for Commerce
- Unrestricted Upload of File with Dangerous Type (CWE-434), CVSS 9.6, allows arbitrary code execution and privilege escalation without authentication
- Exploitation requires user interaction: a victim visits a crafted URL or compromised page, letting uploaded script run in an authenticated user's context and reach admin sessions and back-end APIs
- IOCs include executable files (.php, .phtml, .phar, .js, .html) under pub/media/ or pub/static/ and POSTs to upload endpoints followed by GETs of uploaded artifacts
- Fixes shipped in Adobe advisory APSB26-73 (July 14, 2026); Adobe reports no exploits in the wild
💥 BREACHES & INCIDENTS
- Hackers hijack Convertr analytics script to steal payment card data at checkout
A Magecart group compromised Convertr's self-hosted Plausible analytics script to skim payment card data from Brazilian e-commerce checkout pages.- Affects shoppers on Brazilian online stores using the Convertr e-commerce platform, which powers dozens of major fashion brands handling ~R$2 billion ($370M) in sales
- Attackers injected a skimmer into the Plausible analytics tracker hosted on Convertr's own servers, loading on all merchants' checkout pages since October 24
- Stolen data: card number, expiration date, CVV, cardholder name, and CPF taxpayer ID
- Sansec suspects initial access via CVE-2026-8467, an unauthenticated command-execution flaw in Convertr's outdated Plausible Community Edition; the gang, active since July 2024, also targets Magento, OpenCart, and WooCommerce stores
- A refined skimmer version pushed October 26 targets Convertr's exact payment API field names; Convertr has since removed the skimmer and patched Plausible
🔓 CVEs & KEV
CVE-2026-105489 — Adobe Campaign Classic — CVSS 9.9 — Adobe Campaign Classic (ACC) is affected by an Improper N...
CVE-2026-116692 — mlflow — CVSS 9.8 — MLflow: Remote code execution on unauthenticated MLflow servers via third-par...
CVE-2026-48360 — Adobe Connect Desktop App — CVSS 9.6 — Adobe Connect is affected by an Improper Control of Gener...
CVE-2026-85898 — Microsoft Edge (Chromium-based) — CVSS 8.8 — Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityAccess of ...
CVE-2026-83831 — Microsoft Edge (Chromium-based) — CVSS 8.8 — Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityDouble fre...
CVE-2026-57191 — asterisk — CVSS 8.2 — Asterisk: Stack buffer overflow in MWI NOTIFY Message-Account parsingAsterisk...
CVE-2026-62765 — Microsoft Edge (Chromium-based) — CVSS 7.5 — Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityAccess of ...
CVE-2026-57186 — asterisk — CVSS 7.5 — Asterisk: CVE-2022-37325 fix is absent from current chan_ooh323 Q.931 party-n...
CVE-2026-57200 — asterisk — CVSS 7.5 — Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module pa...
CVE-2026-57195 — asterisk — CVSS 7.5 — Asterisk: NULL Pointer Dereference in HTTP AMI Digest AuthenticationAsterisk ...
CVE-2026-116691 — mlflow — CVSS 6.5 — MLflow CrewAI autologging records LLM provider API keys in logged trace spans...
CVE-2026-57192 — asterisk — CVSS 6.0 — Asterisk: Out-of-Bounds Write in Codec2 Decoder Due to Floor/Ceil Sample Coun...
🕵️ RESEARCH & DEEP DIVES
- SBOMs alone can't reveal scope of a supply chain attack, Shai-Hulud incident shows
An Atlassian product security manager used a real Shai-Hulud worm incident to show SBOMs alone can't scope supply chain compromises without runtime visibility.- Applies to organizations relying on SBOMs and dependency inventories for software supply chain incident response, especially large SaaS environments.
- A malicious transitive dependency named shai-hulud hid three layers deep in a legitimate-looking package with a matching SHA hash and 3,400+ GitHub stars, evading top-level dependency audits.
- The environment's SBOM was two development sprints out of date and reported the environment as clean, while responders couldn't tell which services used the package.
- Without runtime telemetry, responders manually correlated logs across more than 400 services and couldn't establish how far the compromise spread; attribution efforts hit dead ends due to fabricated publisher identities.
- Some later Shai-Hulud attacks have been attributed to a threat actor tracked as TeamPCP.
📋 ADVISORIES
Critical pre-boot RCE flaw in EDK2 PXE driver (CVE-2026-97631) affects most server UEFI firmware
A critical buffer overflow in TianoCore EDK2's PXE network driver allows unauthenticated attackers to execute code before the OS loads.- Affects EDK2-based UEFI firmware used by virtually all server vendors and cloud providers, including builds from AMI, Insyde, Phoenix, and Microsoft's Project Mu; EDK II master as of 2026-09-14 is affected and not yet patched.
- CVE-2026-97631 (CVSS 9.5) is a 16-year-old buffer overflow in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) that copies oversized ICMP error messages past a fixed 504-byte field in both IPv4 and IPv6 handlers.
- During PXE boot, an unauthenticated attacker anywhere on the network can send a unicast ICMP error message to the client's IP to corrupt DXE-phase memory and execute ring-0 code before Secure Boot or measured boot verifies anything.
- Exploitation can hang the boot (denial of OS provisioning) or, if the attacker knows the firmware build, plant a counterfeit event that dispatches attacker-supplied code via CoreSignalEvent().
- The flaw was found by Alex Matrosov (Anthropic) and Dan Holmes (Google); a premature AMI pull request forced early public disclosure, and payloads run only once with no persistence.
Sources 📄 Source: github.com · 📎 Coverage: arstechnica.com · 👁 via InfraTrust Advisories, @dangoodin@infosec.exchange📄 Source for UNM Health ransomware attack diverts ambulances, disrupts patient care and surgeries — hscnews.unm.edu