Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

thehackernews.com Oct 28, 2026

Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

Curated by Shubham · TechCapsules · Oct 28, 2026

AI-summarised brief · reviewed before publication

The U.S. Cybersecurity and Infrastructure Security Agency added Adobe Commerce, Magento, and Google’s Brotli decoder to its Known Exploited Vulnerabilities catalog after evidence of active attacks. Sansec reported that attackers used CVE‑2026‑48356 (PolyShell) to breach hundreds of e‑commerce sites, injecting a malicious loader via a Magento CMS block. CVE‑2026‑111497 (Broccoli2Shell) has also been exploited, with traffic from a Dutch IP targeting Node.js and other platforms. Vendors, including PHP, Node.js, and Google, have released patches, and federal agencies must remediate by November 10, 2026.

💡 Why It Matters

· The widespread use of Brotli in cloud services means the vulnerability could affect millions of deployed applications, turning a routine compression library into a mass‑exploitation vector.
· Prompt patching is essential to prevent large‑scale crashes and potential remote code execution across critical infrastructure.

Capsules Cybersecurity

Read full article on thehackernews.com

Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access…

Tailscale issued version 1.104.4 to remediate critical flaws in its built‑in SSH server that allowed root‑level socket forwarding. The vulnerabilities stemmed from the tailscaled background process, which performed network‑connection forwarding as root after a superficial path check; a timing attack could replace the checked path and grant access to privileged sockets such as Docker’s control socket or the tailscaled local API. Exploitation required an attacker to already control a device permitted by the network’s policy to open an SSH session with forwarding enabled, but no stolen credentials were needed. Researcher Erica Windisch of Cyberdione Labs disclosed the “Tailworm” chain, demonstrating rapid lateral movement across trusted devices and root shell acquisition. The patch changes forwarding to run under the logged‑in user and relies on OS file permissions, while Tailscale advises disabling forwarding via TS_SSH_DISABLE_FORWARDING=1, tightening access rules, and using check mode for sensitive systems. The self‑hosted headscale server remains unpatched as of the latest release.

💡 By turning a trusted device into a conduit for root‑only sockets, the flaw enabled near‑instant lateral escalation across an organization’s zero‑trust network, forcing admins to reassess device‑based trust models.

quantumcomputingreport.com · Oct 28

IonQ Deploys Intercontinental Hybrid QKD and PQC Architecture Securing Enterprise Links Between…

IonQ announced the launch of an operational hybrid quantum‑safe security network linking its Geneva and Seoul facilities. The architecture combines physical quantum‑key distribution (QKD) with algorithmic post‑quantum cryptography (PQC) to protect mission‑critical data and communications against “harvest‑now‑decrypt‑later” attacks. By using QKD for short‑range, high‑density endpoints and PQC for long‑distance key agreement, the deployment overcomes the photon‑attenuation limits of conventional fiber links without relying on untrusted repeaters. IonQ frames the link as a repeatable, defense‑in‑depth blueprint for multinational enterprises and sovereign bodies facing accelerated post‑quantum migration deadlines. The rollout coincides with industry‑wide warnings that 256‑bit elliptic‑curve cryptography could be broken by mid‑2020s quantum computers, prompting tighter regulatory timelines for quantum‑resistant encryption.

💡 It demonstrates a scalable, real‑world model for merging physical and algorithmic quantum defenses, giving global enterprises a concrete path to meet looming quantum‑security mandates.

thehackernews.com · Oct 28

Japan’s GMO Offers $1 Million Bounty to Catch Hackers Behind FX Trading…

Japan’s GMO Internet Group launched the GMO Cybercrime Bounty, offering up to ¥100 million (about $1 million) for information that leads to the arrest or an Interpol Red Notice against the hackers who breached its Onamae.com Desktop Cloud service. The breach, discovered on October 20, exposed login credentials used for foreign‑exchange trading platforms, prompting unauthorized trades on customers’ accounts at brokers such as OANDA Japan. Attackers demanded roughly ¥8 billion ($50 million) and threatened further manipulation of accounts at more than 70 securities firms. GMO shut down the affected servers, reported the incident to police, and will pay only verified tips that directly contribute to apprehending the perpetrators. The bounty program runs until an arrest, a wanted notice, or October 27 2027.

💡 By monetizing actionable intelligence, GMO aims to accelerate law‑enforcement breakthroughs in a breach that directly compromised real‑time trading, exposing a rare, financially tangible incentive to disrupt cyber‑extortion networks.

eurogamer.net · Oct 28

“This is a serious incident” – Kingdom Come: Deliverance developer Warhorse suffers…

Warhorse Studios, the Czech developer behind Kingdom Come: Deliverance, announced on Thursday that it has been hit by a “serious” cyberattack. The studio released a statement at 11 a.m. GMT apologizing to players and confirming that it has engaged cybersecurity specialists to contain the breach and assess its full impact. CEO Martin Frývaldský told a Czech news outlet that the priority is to secure systems, protect employees, partners and the community, and allocate all necessary resources to the response. Warhorse, which is developing a high‑profile open‑world Middle‑Earth RPG based on Tolkien’s works and a new Kingdom Come adventure—presumed to be a sequel—has not provided further updates since the initial notice.

💡 The attack threatens the development timeline of two highly anticipated titles, potentially delaying releases that could shape the studio’s future market position.

quantumcomputingreport.com · Oct 28

NIST Releases Final IR 8547 Establishing Definitive Post-Quantum Cryptography Transition Timeline and…

The National Institute of Standards and Technology released NIST IR 8547, a definitive roadmap for migrating federal and commercial systems from classical public‑key cryptography to post‑quantum cryptography (PQC). Authored by senior members of the Computer Security Division, the document translates Executive Order 14412 and OMB Memorandum M‑26‑15 into binding deadlines: all high‑value federal assets must adopt PQC for key establishment by 31 December 2030 and for digital signatures by 31 December 2031. Classical algorithms are slated for deprecation after 2030 and a total ban after 2035. The roadmap endorses hybrid schemes in FIPS 140 validations, updates SP 800‑56C and SP 800‑227, and triggers enterprise‑level tooling, exemplified by IBM’s new “Quantum Safe” suite, to automate compliance and manage cryptographic inventories.

💡 By fixing hard dates for PQC adoption, NIST forces organizations to confront “harvest‑now, decrypt‑later” threats before quantum computers become capable of breaking today’s encryption.

thehackernews.com · Oct 27

GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption

The GoAhead embedded web server’s TLS implementation failed to enforce certificate revocation when using the OpenSSL backend with mutual‑TLS. Although a revocation list could be loaded, the server never enabled checking, allowing revoked client certificates to authenticate successfully. The flaw affects builds that require client certificates, a trusted CA bundle, issuer checking, and a configured revocation list; Mbed TLS builds are unaffected. GoAhead 6.1.1, released to manufacturers on August 2 2026 and publicly on October 12, patches the issue. Discovered by Sébastien Féry of FoxIO, the vulnerability is tracked as CVE‑2026‑115881 with a vendor‑assigned severity of 9.1. Fix deployment depends on each device maker updating firmware, and no exploitation has been reported. Routers, printers and controllers could remain exposed until updates arrive firmware.

💡 Hundreds of millions of network‑critical devices could stay insecure for months, giving attackers a stealthy path to hijack management interfaces.