CISA added this to KEV on 2026-10-27 with public exploits already in VulnCheck XDB and emergency fixes shipped by Node.js, Microsoft .NET and PHP, so a service that still decodes Brotli content from the network with an unpatched library can be taken over by a single crafted request or response.
An unchecked return value in Google's Brotli decoder lets a crafted Brotli-compressed stream corrupt adjacent decoder state, leaking memory or executing arbitrary code in any process that decompresses attacker-supplied Brotli data without authentication. The decoder ships inside Node.js, .NET, the PHP cURL extension, Bun, Envoy Proxy, Istio and Python HTTP clients, so HTTP servers and clients that accept Brotli-encoded bodies are reachable targets.
Affected: Google Brotli 1.0.3 to before 1.0.10; Google Brotli 1.1.0 to before 1.1.1; Google Brotli 1.2.0 to before 1.2.1; Node.js 26.x, 24.x and 22.x release lines before the October 21, 2026 security releases; Microsoft .NET builds before the emergency Brotli security updates; PHP 8.2 through 8.5 official Windows packages before the rebuilt packages; andybalholm/brotli (Go) before v1.2.7; Debian packages covered by the October 2026 debian-lts-announce msg00049 update
How to Test
Inventory every component that links the Brotli decoder: check the system libbrotli version against 1.0.10 / 1.1.1 / 1.2.1 for its branch; compare installed Node.js against the 26.x, 24.x and 22.x builds from the October 21, 2026 security release; confirm the emergency .NET security update is installed; on Windows confirm PHP 8.2–8.5 is running the rebuilt packages; check Go modules for andybalholm/brotli below v1.2.7; and review Envoy, Istio, Bun and Python HTTP client deployments for their bundled decoder version. To look for prior abuse, review crash logs and core dumps from processes that decode Brotli, and inspect access logs for unusual Brotli-compressed request or response bodies hitting endpoints that decompress them.
How to Patch
Upgrade libbrotli to 1.0.10, 1.1.1 or 1.2.1 depending on branch; apply the Node.js October 21, 2026 security releases for the 26.x, 24.x and 22.x lines; install Microsoft's emergency .NET security updates; replace PHP 8.2–8.5 Windows packages with the rebuilt releases; upgrade andybalholm/brotli to v1.2.7; apply the Debian LTS update from debian-lts-announce 2026/10/msg00049. Where an upgrade must wait, disable Brotli content decoding in the affected application or proxy so untrusted Brotli streams are not decompressed.
CISA added this to KEV on 2026-10-27 after Sansec documented a mass attack wave against Commerce and Magento stores still on pre-July-2026 builds, so a storefront that has not applied APSB26-73 should be treated as targeted and checked for web shells now.
An unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento Open Source lets an attacker without credentials get code executed in the context of the current user, gaining control of the account or session; Adobe's vector records a user-interaction step. Sansec associates the flaw with the PolyShell mass attack wave and a CMS block loader implant on stores that did not apply the July 2026 update.
Affected: Adobe Commerce 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier; Adobe Commerce B2B 1.5.3, 1.5.2-p5 and earlier, 1.4.2-p10 and earlier, 1.3.4-p17 and earlier, 1.3.3-p18 and earlier; Magento Open Source 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier; Adobe Commerce Events 1.6.0 to 1.20.0
How to Test
Confirm the installed release is one of the 2026-jul builds (for example 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul, 2.4.4-2026-jul, or Commerce Events 1.21.0); anything older is exposed. To check for compromise, work through Sansec's indicators of compromise for the CMS block loader / DeepVeinDrilling and PolyShell campaigns (https://sansec.io/research/magento-cms-block-loader-deepveindrilling#indicators-of-compromise): review CMS blocks for injected loader code, search web-accessible directories for recently uploaded files with executable types, and audit admin accounts and sessions for unexpected activity.
How to Patch
Upgrade per APSB26-73 to Adobe Commerce 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, 2.4.5-2026-jul or 2.4.4-2026-jul; Adobe Commerce B2B 1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul or 1.3.3-2026-jul; Magento Open Source 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul or 2.4.6-2026-jul; and Adobe Commerce Events 1.21.0.
VulnCheck's canary sensors recorded exploitation attempts against this bypass on 2026-10-28 and it was added to VulnCheck KEV the same day, so LibreNMS instances below 26.8.0 with any API token are at risk of credential theft and server takeover from unauthenticated requests.
LibreNMS compares the API token against the token_hash column, and sending a small integer (0–9) instead of a string makes MySQL coerce the column to a number so the attacker matches a real token without knowing it. The attacker inherits that token owner's access to the whole /api/v0 REST API, including stored SNMP credentials for every device, and an admin token allows remote code execution through Blade @php blocks in alert templates. At least one enabled API token must exist on the target.
Affected: LibreNMS <= 26.7.0 (all versions before 26.8.0)
How to Test
Check the running version (LibreNMS/Util/Version.php or the About page); anything below 26.8.0 is affected if any API token exists. Review web server logs for requests to /api/v0/* (especially GET /api/v0/devices) sent with no X-Auth-Token header and a JSON body whose api_token is a bare number such as 0–9 or an array such as [0], inspect alert templates for unexpected @php blocks, and treat SNMP community strings, authpass and privpass values stored in LibreNMS as exposed if such requests are found.
How to Patch
Upgrade LibreNMS to 26.8.0 or later per https://github.com/librenms/librenms/security/advisories/GHSA-cvq8-gqfq-3mvg. If the upgrade must wait, disable or delete all API tokens (the bypass needs an existing enabled token to match) and restrict network access to /api/v0; rotate any SNMP credentials that may have been read.
Confirmed Breachcritical
The extortion deadline passed on 2026-10-27 with customer data now public and credentials from the hosted desktops already being used for unauthorized trades, so any key still live on one of those instances is being exercised this week.
GMO Internet detected an intrusion into its Onamae.com Desktop Cloud VPS/virtual-desktop service on 2026-10-20 that could have installed malware on as many as 26,739 customer servers. GMO shut the servers down, refused a ~$50M extortion demand, and on 2026-10-27 the attacker published data that GMO confirmed belongs to both the company and its customers; a broker has tied unauthorized FX trades to logins leaked from the service.
Affected: GMO Internet Onamae.com Desktop Cloud — customer VPS/virtual desktop instances active on or after 2026-10-20; GMO Internet Onamae Desktop Cloud — Windows desktops used for FX trading
How to Test
Check GMO's customer notifications and control panel for whether your tenant is among the ~26,739 flagged servers; from a clean machine review FX/broker and banking account activity for unauthorized orders since 2026-10-21, pull authentication logs for your VPN, cloud and SaaS accounts for logins sourced from the Onamae hosting ranges, and if you can mount the disk offline inspect it for unexpected scheduled tasks, services and run-key persistence rather than booting it.
How to Mitigate
Do not restore or reconnect the original instances — rebuild Onamae Desktop Cloud workloads from clean images on a different host, rotate all passwords, API keys, certificates and MFA seeds that touched those desktops, invalidate existing sessions/refresh tokens for any service reached from them, and ask brokers and payment providers to re-verify recent transactions.