October 28, 2026 is shaping up to be one of the more consequential patch days of the year. CISA has confirmed active exploitation of multiple critical vulnerabilities spanning PHP runtimes, Adobe Commerce storefronts, and the widely embedded Google Brotli compression library. Taken together, these disclosures paint a picture of threat actors systematically targeting foundational web infrastructure — the kind of software that quietly powers millions of applications and is often deprioritized in patching cycles precisely because it sits beneath the application layer.

The most urgent story today centers on PHP2Shell and the underlying PHP memory corruption flaw tracked as CVE-2026-109618, carrying a CVSS score of 9.2. CISA has confirmed this vulnerability is being actively exploited in the wild and has issued a mandate requiring federal agencies to patch by Thursday. The flaw enables unauthenticated remote code execution, meaning an attacker with network access to a vulnerable PHP installation needs no credentials whatsoever to achieve full server compromise. A related PHP2Shell vulnerability compounds the risk by providing a ready-made exploitation path that lowers the technical bar for attackers. Any organization running PHP-based web applications — which is to say, a very large portion of the internet — should treat this as an emergency response situation, not a routine patch cycle.

Equally serious for organizations running e-commerce infrastructure is CVE-2026-48356, an unrestricted file upload vulnerability affecting Adobe Commerce and Magento. This class of vulnerability is particularly dangerous in retail and payment environments because it allows attackers to upload malicious files — including web shells — directly to the server, establishing persistent footholds that can survive reboots and even some remediation attempts. Magento-based storefronts are perennial targets for payment card skimming operations and ransomware groups, and an unrestricted upload flaw is precisely the kind of initial access vector those actors seek. If your organization operates an Adobe Commerce or Magento instance, assume this is being actively probed right now.

Rounding out the KEV additions is CVE-2026-111497, an unchecked return value vulnerability in Google Brotli. Brotli is a compression algorithm library embedded in browsers, web servers, content delivery systems, and countless application dependencies. An unchecked return value flaw may sound less dramatic than remote code execution, but in practice it can lead to memory corruption, application crashes, or exploitable conditions depending on how the library is integrated. The breadth of Brotli's deployment means the attack surface here is enormous and often invisible — organizations may not even know they are running an affected version because it is bundled inside other software.

CISA also unveiled a new national cyber defense strategy today, signaling a continued federal push toward proactive infrastructure hardening. While the strategic details will take time to filter into operational guidance, the timing alongside these active exploitations underscores the core message: reactive patching is no longer sufficient, and organizations need continuous visibility into their software inventory.

Defensive priorities for today:

- Immediately audit all PHP installations across your environment and apply available patches for CVE-2026-109618. If patching cannot be completed before Thursday, implement network segmentation to restrict external access to PHP-based services and enable web application firewall rules targeting PHP2Shell exploitation patterns.

- For Adobe Commerce and Magento deployments, apply the vendor patch for CVE-2026-48356 without delay. In the interim, review file upload configurations, restrict permitted file types at the application and server level, and audit recently uploaded files for anomalies. Check for web shells in publicly accessible directories.

- Conduct a dependency audit to identify all software components that bundle Google Brotli and cross-reference against the affected version range for CVE-2026-111497. Prioritize updates for internet-facing services and any components handling untrusted compressed input.

- Review SIEM and EDR telemetry for indicators consistent with PHP-based web shell activity: unusual child processes spawned by web server processes, outbound connections from web server hosts to unfamiliar destinations, and new files written to web-accessible directories.

- Validate that your vulnerability management program includes software composition analysis capable of detecting embedded libraries like Brotli, which are frequently missed by traditional asset scanning.

- Align patching timelines with CISA's KEV catalog deadlines even if your organization is not a federal agency — these deadlines reflect confirmed exploitation and represent a reasonable urgency benchmark for any security program.

The convergence of these vulnerabilities in a single day is a reminder that attackers do not wait for convenient patch windows. PHP infrastructure, e-commerce platforms, and compression libraries are not glamorous targets, but they are ubiquitous ones, and ubiquity is exactly what mass exploitation campaigns require.

This briefing is informational and intended to support your team's situational awareness — always consult official vendor advisories and CISA guidance for authoritative remediation instructions.