Good morning. CISA added Magento’s PolyShell cart upload flaw to its exploited list on Tuesday, and Sansec says the group behind it reached at least one store that was fully patched. Apple fixed 286 flaws and brought an exploited iPhone fix to older models, a Microsoft Authenticator bug let rogue Android apps take work accounts, and the Brotli bug we covered this week now has real exploit traffic.
Lead Story
CISA lists PolyShell as exploited: anyone can upload files through a Magento store’s guest cart, and Sansec ties it to a loader campaign that has reached 953 stores. Patch and hunt the store →
Also Worth Your Attention
Apple’s 27.2 updates fix 286 flaws, and iOS 18.7.11 brings the exploited CoreGraphics fix to the iPhone XS and XR. Set the new minimums →
Don’t Miss the Policy Changes That Affect Security Decisions
Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Microsoft Authenticator for Android handed work account tokens to any app that claimed to be Teams. The fix is version 6.2606.4246. Check every phone →
The Brotli decoder bug now has in-the-wild exploit traffic aimed at Node.js 24.22.0, and CISA has listed it. Retire 24.22.0 today →
Also on the radar: Thursday, October 29, is CISA’s federal deadline for the two PHP2Shell flaws (CISA alert). Tailscale is preparing a client fix for the “Tailworm” Tailscale SSH flaws published over the weekend; until it ships, set TS_SSH_DISABLE_FORWARDING=1 for tailscaled and tighten SSH access policies (BleepingComputer). Microsoft released out-of-band updates KB5134133 and KB5134125 that remove trust in eMudhra roots for Windows machines that do not get automatic certificate trust list updates (BleepingComputer).
Hardening a store or web server this week? Our GSEC exam guide covers the basics of locking down what attackers reach first.
Source: CISA KEV addition; Sansec on the store loader; Apple security releases; Enclave on Authenticator; ELLIO on Brotli exploit traffic
Go Deeper
- Identity and access management: tokens, passkeys and sign-in apps
- Cybersecurity tools for web server checks and log review
Get this in your inbox every weekday morning: subscribe to the Daily Brief.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
