Today, attackers are targeting vulnerabilities in Adobe Commerce and Magento, as well as Google Brotli. Small businesses using these products should review their security to protect against potential exploitation.
Adobe Commerce and Magento (CVE-2026-48356)
Adobe Commerce and Magento contain an unrestricted upload of file with dangerous type vulnerability. An attacker could upload and execute malicious code, gaining elevated access or control over the victim's account or session. Businesses should update to the latest version and ensure all security patches are applied.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Google Brotli (CVE-2026-111497)
Google Brotli contains an unchecked return value vulnerability. This allows attackers to corrupt memory, disclose sensitive data, or cause a denial of service. Businesses should update to the latest version to mitigate the risk.
What to do: Install the maker's update now. If there is no update yet, follow the maker's own steps to reduce the risk, and stop using the product until it is fixed if neither is available.
Tip of the day: Switch on two-step sign-in
Email, banking and Microsoft 365 or Google accounts first. A stolen password alone is then not enough to get in.
Doing it once, properly
Saving now often means paying twice: cut-price IT work is frequently rebuilt from the start, and the outage or breach before the rebuild is the expensive part.
Sources
- CISA Known Exploited Vulnerabilities catalogue
- CVE-2026-48356 on the National Vulnerability Database
- CVE-2026-111497 on the National Vulnerability Database
Written each morning from CISA's catalogue of vulnerabilities known to be exploited, with the help of an AI model that runs on our own server. Check the sources before acting, and talk to us if you are not sure whether you are affected.