Cyber Security News

Hacking Editorial Brief — October 29, 2026

CISA Adds Actively Exploited E-Commerce Vulnerabilities to KEV Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog as researchers report active exploitation against Adobe Commerce and e-commerce platforms. CVE-2026-48356 (PolyShell) and CVE-2026-111497 (Brotli/Node2Shell) are being exploited for remote code execution, according to CISA and Bleeping Computer. The Hacker News reports that PolyShell attacks have breached hundreds of online stores, though the exact compromise count and whether these represent confirmed incidents or researcher observations has not been specified. The Brotli vulnerability, which Bleeping Computer describes as a "critical" Node2Shell flaw, allows attackers to achieve remote code execution. The addition to CISA's catalog indicates federal agencies observed active exploitation in the wild, triggering mandatory remediation requirements for federal civilian networks under Binding Operational Directive 22-01.

Nonprofit Publishes DHS Personnel Data Following March Breach

Transparency collective Distributed Denial of Secrets published personal information on more than 40,000 Department of Homeland Security employees following a breach the group Department of Peace claimed responsibility for in March 2026, according to multiple outlets including NPR, The Guardian, and Wired. The leaked data includes names, phone numbers, email addresses, office assignments, and in some cases home addresses of personnel across DHS agencies including ICE. Wired reports the dataset includes information on undercover ICE agents, though the extent to which operational security has been compromised remains unclear. DDS co-founder Emma Best confirmed the organization received the data from Department of Peace and Swiss hacker maia arson crimew, then created a searchable online database. The initial March compromise reportedly involved documents related to contracts with outside vendors; whether the personnel data represents an expansion of that breach or a separate intrusion has not been disclosed. DHS has not publicly confirmed the breach scope or validated the authenticity of the published records.

Sources: The Hacker News · Bleeping Computer · NPR · The Guardian · Wired