CISA added CVE-2026-48356, an unrestricted file-upload flaw in Adobe Commerce and Magento, to its Known Exploited Vulnerabilities catalog on Oct 27, citing evidence of active exploitation. Adobe patched the flaw in APSB26-73 on July 14; federal civilian agencies must remediate by Nov 10.
CISA lists the flaw as actively exploited.
The vulnerability allows code execution in the current user context.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
CISA has added CVE-2026-114625, a critical SQL injection bug in Arista VeloCloud Orchestrator, to its KEV catalog with an October 26 deadline. Fixed releases are 5.2.3.18, 6.1.3.10 and 6.4.2.12.
CISA added CVE-2026-110447, an OS command injection flaw in Collabora Online's built-in CODE server used within Nextcloud, to its Known Exploited Vulnerabilities catalog on October 23. It allows remote code execution; federal agencies must mitigate by October 26 under BOD 26-04.
ADT and Thrive Holdings announced an all-cash deal that values ADT at about $7.6 billion in equity value and $15.3 billion in enterprise value, according to the companies. ADT stockholders would get $10.00 per share, and the companies expect the deal to close in the first quarter of 2027, pending stockholder and US antitrust approval.
CISA says it added Linux kernel flaw CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on Oct. 28, with a federal deadline of Oct. 31 and forensic triage required. CISA says it can be chained with two PHP flaws to implant webshells and run commands as root.
CISA says it added CVE-2026-41709, an insufficient logging flaw in Broadcom's VMware ESX, to its Known Exploited Vulnerabilities catalog on Oct. 28. The flaw requires admin access, and CISA lists a Nov. 11 federal deadline; it has not said who is exploiting it.
