Daily Briefing

CISA flags two actively exploited flaws — Adobe Commerce/Magento and Google Brotli — as the Brotli bug spreads well beyond Node.js

By The IT Security Desk

Good morning. CISA says it added two vulnerabilities to its Known Exploited Vulnerabilities Catalog on 27 October based on evidence of active exploitation: an unrestricted upload of a file with a dangerous type in Adobe Commerce and Magento, and an unchecked return value flaw in Google Brotli. CISA says Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritise rapid remediation of catalogued vulnerabilities. If you run either product, treat these as in-the-wild and remediate per the vendor advisory; match the affected products CISA lists against your estate rather than assuming reach.

The Brotli flaw matters well beyond its headline product. Help Net Security reports that the bug in Brotli — Google's widely used open-source compression library, tracked under the nicknames "Node2Shell", "Broccoli2Shell" and "Brotli2Shell" — is a remotely exploitable out-of-bounds write that puts a broad range of software at risk. Because the library is bundled widely, inventory where Brotli is embedded, not only where Node.js is installed.

SecurityWeek reports that Tailscale is preparing a patch for Tailscale SSH flaws, dubbed "Tailworm", whose details went public over the weekend before any fix had been released. If you run Tailscale SSH, watch for the vendor's patch and apply it when issued.

Read the full briefing →