· 5 min read · LNX Inc.

MSP Threat Briefing: October 28, 2026

CISA lists the Brotli decoder flaw and Adobe Commerce PolyShell as exploited. Both carry a November 10 federal deadline.

A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn

CISA added two flaws to its exploited list on October 27. One is the Brotli decoder bug covered here for the past week. The other is PolyShell, a file upload flaw in Adobe Commerce and Magento that a skimming crew has used against hundreds of stores.

  1. Finish Brotli patching on Node.js, .NET, Python and Windows PHP, starting with internet-facing Express 5 apps. Restart every updated process.
  2. Confirm every Adobe Commerce or Magento store you manage has Adobe's APSB26-73 fix. Then check its database and media folders for the indicators below, even if it is patched.
  3. Keep ConnectWise Cloud Backup app connections disabled until ConnectWise sends restoration instructions.

1. Update: CISA adds the Brotli decoder flaw to its exploited list

This follows item 2 in the October 27 briefing. CISA added CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27 (CISA alert). The catalog sets a November 10 due date for federal civilian agencies.

The evidence is still thin, but it is growing. Previdian's sensor page shows one exploitation attempt on October 27 from a US address. Previdian notes this does not show the target was vulnerable or that the attempt worked. ELLIO's analysis of the October 26 payload found it never reached code execution in 50 tries against a vulnerable Node.js 24.22.0 build. ELLIO calls it likely a "first-generation attempt". Expect better versions.

ELLIO also says the source address, 94.154.43[.]7, carries tags for PHP2Shell exploitation and GlobalProtect and FortiOS SSL VPN probing. If it shows up in your logs, check all three.

Who is exposed. Clients running custom web apps, portals or APIs on Node.js, ASP.NET Core or Python that decompress outside data. Sysdig's reachability table marks Express 5 with express.json() as reachable by default. Express 4 with body-parser 1.20.x rejects Brotli bodies, but other middleware or proxies in front of it may not. Sysdig also lists Koa body parsers and Fastify with @fastify/compress. Server-side fetch() decodes Brotli responses, so outbound calls to untrusted servers count too.

What to do.

  • Update Node.js to 22.23.4, 24.22.1 or 26.12.1 (Node.js security release). Move end-of-life lines to a supported one.
  • Install .NET 8.0.33, 9.0.22 or 10.0.14 and rebuild self-contained apps (.NET blog).
  • Update the Python Brotli package to 1.2.1 and brotlicffi to 1.2.1.0. On Windows PHP hosts, install the -1 builds (php.net).
  • Run node --version inside running containers, not only on the host image list. Restart and redeploy after updating.
  • Watch web-facing Node.js processes for a crash followed by a shell or an unexpected outbound connection. A sensor will not see the overflow, only what follows it.
  • The indicator table in the October 27 briefing still applies. ELLIO published no new indicators after October 26.

2. Adobe Commerce PolyShell is exploited and on the CISA list

CVE-2026-48356, known as PolyShell, is an unrestricted file upload flaw in Adobe Commerce and Magento Open Source. It can lead to code execution on the server. Adobe fixed it in security bulletin APSB26-73 in July 2026. CISA added it to the exploited catalog on October 27, also with a November 10 due date.

The main campaign is documented by Sansec, the researcher. Its October 24 report tracks one operator across 953 stores since July 2025. The operator uploaded webshells through PolyShell, then planted a JavaScript loader in Magento's cms_block table. In March, 471 stores were infected in one hour. The loader serves its payload only to real shoppers, which hides it from scanners. Sansec has not recovered the final payload, so the goal is unclear. The Hacker News reports that the campaign is ongoing.

Two details matter for cleanup. The loader can give the attacker write access to the database, and deleting the script does not remove it. And Sansec found the loader on a fully patched 2.4.7-p10 store after a clean scan. Patching closes the door. It does not evict someone already inside.

Who is exposed. Clients with a self-hosted Magento or Adobe Commerce store, including stores an agency built and nobody has updated since. Sansec found that 60% of Magento 2 installs missing a core patch also had files uploaded through PolyShell or SessionReaper (CVE-2025-54236).

What to do.

  • Confirm APSB26-73 (PolyShell) and APSB25-88 (SessionReaper) are installed. Check the store's version in its admin panel against Adobe's bulletin.
  • Search cms_block.content and cms_page for fpCode, se_referrer and localStorage.getItem. Include your table prefix. Check update_time for recent writes.
  • Look for unexpected files in pub/media/custom_options/ and pub/media/customer_address/, and for accesson.php anywhere in the webroot.
  • Review admin_user for accounts nobody recognizes.
  • If you find the loader, remove it, remove webshells, and change database, admin and API integration passwords. Returning shoppers may keep running the payload from browser storage after you remove it.
Indicator (from Sansec)Value
Current loader domaindeepveindrilling[.]com (registered October 6, 2026)
Earlier loader and tracker domainsadditionalver[.]com, lanhd6549tdhse[.]top, neswnsssn[.]click, manulfie[.]click, hdfdsi84j3h[.]top, c85grt98sd[.]com
Payload URLsleqdger[.]click/ssl/, crypto-insider[.]top/ssl/
Decoy response stringQWE=123;
Browser localStorage keysfpCode, 136c1e07507f4a97, 136c1e07507f4a98
Database locationcms_block.content, also cms_page

Quick hits

ConnectWise Cloud Backup. Restoration is ready but waiting on a third-party validation, per the October 27 update. Backup restore access comes first, then full re-enrollment with instructions. ConnectWise lists no new indicators and says existing backup archives show no sign of compromise. Keep affected app connections disabled and keep reviewing client Microsoft 365 tenants.

Sources

threat-briefingmanaged-it

More from LNX

All posts →
A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 29, 2026 CISA lists Fragnesia, a Linux kernel flaw chained with PHP2Shell to get root on firewalls. Federal deadline is October 31. ConnectWise starts restores. Read the post → A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 27, 2026 CISA adds PHP2Shell to its exploited list, and the Brotli decoder flaw now has .NET and PHP for Windows fixes plus reported exploit traffic. Read the post → A security analyst seen from behind, reviewing three monitors of status tiles and a world map in a dark office before dawn MSP Threat Briefing: October 26, 2026 PHP2Shell now has confirmed successful exploitation, and CISA lists an exploited flaw in Nextcloud's built-in Collabora CODE server. Read the post →

Tell us what's in front of you.

A drawing set, a failing switch, an audit deadline, or a hunch that IT costs too much. We'll tell you who picks it up and what it takes.

Request a quote Book an assessment (833) 569-5690 · Mon–Fri 8–4