CISA Warns of Node2Shell Exploitation as Oracle EBS Probes Begin

CISA confirmed on Tuesday that hackers are exploiting CVE-2026-111497, a critical flaw in Google's Brotli compression decoder, and added it to the Known Exploited Vulnerabilities catalog, ordering federal agencies to patch by November 10. The agency said the unchecked return value vulnerability "allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code" when a crafted Brotli stream is processed. BleepingComputer reported the defect stems from an out-of-bounds write and can cause crashes, memory leaks or allow attackers to run code on machines where the Brotli library is vulnerable.

Researchers have already observed attempts. Previdian recorded one attempt by October 27, and ELLIO detected traffic that included a public exploit capable of code execution, Security Affairs reported. Wiz found that resources vulnerable to the flaw exist in 91% of cloud environments, and 82% have publicly exposed Node.js instances.

Microsoft pushed an emergency .NET update on Sunday warning that attackers could use the flaw to escalate privileges, and Node.js, PHP, Bun and Microsoft .NET have released fixes. If patching is delayed, CISA advises blocking incoming Brotli-compressed requests at a proxy or firewall or disabling Brotli decoding, then restarting affected processes and rebuilding container images after updates.

Separately, SecurityWeek reported that threat intelligence firm Defused saw the first probing attempts on October 27 against CVE-2026-101767, a newly patched SQL injection in Oracle E-Business Suite's Application Object Library. Defused said on X: "Our Oracle E-Business Suite decoys recorded exploratory exploits against CVE-2026-101767 this morning, Oct 27". The flaw, rated CVSS 9.8 and fixed in Oracle's October CPU, can be exploited over HTTP by unauthenticated attackers to achieve remote code execution and take over the Application Object Library, SecurityWeek said. Horizon3.ai discovered and reported the bug, and no other in-the-wild exploitation reports had emerged.

Oracle EBS flaws often draw attackers. Defused warned in June of exploitation of CVE-2026-46817, and Cl0p used zero-day bugs in Oracle enterprise management software last year, SecurityWeek reported. A large-scale EBS hacking campaign potentially affected more than 100 organizations in industries from energy to telecommunications.

CISA also added CVE-2026-48356, an unrestricted file upload flaw in Adobe Commerce and Magento dubbed PolyShell, to the KEV catalog, according to Security Affairs. WordPress security firm Sansec warned that attackers exploited the flaw to infect at least 953 online stores, using a Magento CMS block to insert a loader that retrieves and executes a payload; researchers have not recovered the payload and the campaign's goals are not known. Security Affairs reported that the activity is believed to have started by July 2025 and is still ongoing.

Deadlines differ by source. BleepingComputer said CISA set a November 10 deadline for Node2Shell under Binding Operational Directive 26-04, while Security Affairs said CISA gave federal agencies until October 29, 2026 to remediate the flaws. Defenders should review the KEV catalog, prioritize these patches, and apply the temporary Brotli mitigations if updates cannot be installed immediately.