Sansec has traced malicious JavaScript loaders in 953 online stores, most of them running Magento, to a single unknown actor active since at least July 2025. This Magento store JavaScript malware hides in database content that file scanners skip and reveals itself only to real shoppers, so a clean scan report does not prove a clean store.
A 26 October 2026 engineering post from the InterceptSuite team shows why the HTTP/3 proxy blind spot exists: HTTP/3 runs over QUIC on UDP, so TCP-based proxies such as Burp Suite never receive the packets. There is no CVE and nothing to patch. If your firewall, logs or test tooling only understand TCP, though, part of your HTTPS traffic is passing them by.
The Brotli vulnerability CVE-2026-111497, nicknamed HTTP2Shell, is a buffer overflow in Google's compression decoder that can crash processes, leak memory and allow remote code execution in Node.js, Python and .NET applications. Proof-of-concept exploits are public, and updating the system Brotli package, the fix most admins try first, leaves many deployments still vulnerable.
Attackers have achieved confirmed remote code execution through PHP2Shell, two critical PHP flaws tracked as CVE-2026-109618 and CVE-2026-109619. PHP shipped fixes on October 21. The catch for PHP2Shell shared hosting customers: the bug sits beneath WordPress and Joomla, so only your host can install the fix.
Attackers are using an on-prem VeloCloud exploit, CVE-2026-114625 (CVSS 9.9), to turn the lowest-privilege Enterprise Read Only portal account into local superuser on the Arista VeloCloud Orchestrator host. That host runs the SD-WAN management plane for every branch and site it controls. A forgotten login is now the shortest path to the management plane.
Group-IB and NyxLab have tied more than 70,000 exposed credentials for Fortinet FortiGate, FortiWeb and Palo Alto Networks GlobalProtect devices to a threat actor tracked as k0t. This FortiWeb credential leak comes with no CVE to patch, so the fix is in your accounts, sessions and logs, not your firmware update queue.
Atlassian has disclosed a critical path traversal vulnerability affecting eight of its self-hosted Data Center products, including Jira, Confluence and Bitbucket. Tracked as CVE-2026-21589 with a CVSS score of 9.3, the flaw can allow an unauthenticated party to read certain files from the web application root directory.
Atlassian’s cloud-hosted products have already been fixed. Organizations running their own Data Center instances need to update them.
