Attackers target Brotli, Adobe Commerce and Magento vulnerabilities
Comments on “Attackers target Brotli, Adobe Commerce and Magento vulnerabilities”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Attackers are actively exploiting two flaws: "Broccoli2Shell," a Brotli decoder vulnerability (CVE-2026-111497, affecting versions 1.0.3 through 1.2.0) that lets unauthenticated users inject malicious code, and an Adobe Commerce/Magento unrestricted file upload bug (CVE-2026-48356). CISA has added both to its Known Exploited Vulnerabilities catalog.
Why it ranked
No. 68 of 110 with a score of 0.60. The panel rated it highest on practical relevance (0.86) and reader interest (0.80), lowest on technical depth (0.52). The judges disagreed most on new information (spread 0.63), so the story is marked contested. The claim check took 0.100 off. Placed No. 68, No. 58 by score alone: the 19th Security story of the day (−0.080). The placement terms move stories; they are not part of the score.
- AI judgeJudge 2claude-haiku-5-5
- Active exploitation of critical Brotli and Adobe Commerce/Magento flaws with patch guidance; important for builders, but largely a news summary with limited technical depth and mostly already-known vulnerabilities.
- AI judgeJudge 3gpt-5.6-luna
- Timely, actionable reporting on active exploitation of Brotli and Magento vulnerabilities, with affected versions, patch guidance, campaign evidence, and broader patch-speed data. Brotli details overlap prior coverage, but the Magento campaign and combined alert add new information.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.60total under rubric v2.3Contestedjudges differ by 0.63 on new information
- Significance0.63
- Reader interest0.80
- Audience breadth0.67
- Practical relevance0.86
- Substantiated0.64
- Technical depth0.52
- New information0.57
- Counts against: Promotional0.03
- Counts against: Overclaim0.16
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.71 | 0.50 | 0.68 | 0.63 | 0.21 | +0.24 | +0.151 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.78 | 0.80 | 0.82 | 0.80 | 0.04 | +0.26 | +0.208 |
| Audience breadthHow many people who build technology does it concern? | 0.72 | 0.67 | 0.62 | 0.67 | 0.10 | +0.13 | +0.087 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.91 | 0.85 | 0.82 | 0.86 | 0.09 | +0.22 | +0.189 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.59 | 0.60 | 0.72 | 0.64 | 0.13 | +0.05 | +0.032 |
| Technical depthHow technically substantive is it? | 0.68 | 0.40 | 0.48 | 0.52 | 0.28 | +0.05 | +0.026 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.77 | 0.15 | 0.78 | 0.57 | 0.63 , above the contested threshold | +0.05 | +0.028 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.03 | 0.01 | 0.03 | 0.04 | −0.19 | −0.006 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.21 | 0.15 | 0.12 | 0.16 | 0.09 | −0.11 | −0.018 |
| Sum of contributions | +0.698 | ||||||
| Claim-check penalty | −0.100 | ||||||
| Total, as published | 0.598 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-29/68/"><img src="https://rubric.hrih.si/badge/2026-10-29/68.svg" alt="Ranked #68 on Rubric, 29 Oct 2026" width="245" height="28"></a>Claim check
Claim check: 3 matches source · 1 differs from source · 1 no source given · 3 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceNumber
CISA has added the Adobe Commerce and Magento vulnerabilities to its Known Exploited Vulnerabilities catalog.
The cited source says the same thing.
The article says “has added them to its “Known Exploited Vulnerabilities” catalog”
The source says “CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation”
Source cited by the article: cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog
Differs from sourceNumber
The Adobe Commerce/Magento flaw CVE-2026-48356 has an NVD CVSS score of 9.3, rated critical.
The cited source says something else; both quotes are shown.
The article says “CVE-2026-48356, CVSS score according to NVD: 9.3, risk: “critical”
The source says “CVE-2026-48356 Vulnerability category: Unrestricted Upload of File with Dangerous Type ( CWE-434 ) Vulnerability impact: Privilege escalation Severity: Critical Authentication required to exploit? No CVSS base score: 9.6”
Source cited by the article: adobe.com/trust/security/products/commerce/apsb26-73.html
Couldn’t checkCausal conclusion
The Adobe Commerce/Magento vulnerability allows unrestricted uploads of dangerous file types, enabling arbitrary code execution in the context of the current user account.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “allows unrestricted uploads of files with dangerous file types, enabling arbitrary code to run in the context of the current user account”
The source says No passage could be compared.
Source cited by the article: adobe.com/trust/security/products/commerce/apsb26-73.html
Couldn’t checkNumber
Sansec's analysis says the attack group has compromised at least 953 stores since July 2025, mostly running Magento.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “the group has compromised at least 953 stores since July 2025, mostly running Magento”
The source says No passage could be compared.
Source cited by the article: sansec.io/research/magento-cms-block-loader-deepveindrilling
Matches sourceDate
In March, the group used the flaw dubbed PolyShell to upload web shells.
The cited source says the same thing.
The article says “In March, it used the flaw dubbed “PolyShell” to upload web shells”
The source says “In March the operator injected the loader into 471 stores in one hour, after uploading webshells through PolyShell (CVE-2026-48356”
Source cited by the article: sansec.io/research/magento-cms-block-loader-deepveindrilling
Couldn’t checkGeneralization
The Brotli vulnerability affects anything that uses Brotli libraries to decode the compression format, not just Node.js.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “It affects anything that uses Brotli libraries to decode the compression format”
The source says No passage could be compared.
Source cited by the article: heise.de/news/Brotli-Decoder-Luecke-nicht-nur-in-Node-js-sondern-auch-in-Bun-Python-und-mehr-11499975.html
No source givenVersion
The Brotli flaw CVE-2026-111497 has a CVSS4 score of 9.2 and affects Brotli versions 1.0.3 through 1.2.0, with patched versions 1.0.10, 1.1.1 and 1.2.1.
The article gives no link or citation for it.
The article says “vulnerable Brotli libraries (versions 1.0.3 through 1.2.0). If so, they should update to the patched versions 1.0.10, 1.1.1 or 1.2.1”
The source says No source to compare with.
Matches sourceNumber
Rapid7's Q3 threat landscape report finds attackers begin targeting serious vulnerabilities an average of three days after disclosure, and 71 percent of exploit attempts occurred within seven days.
The cited source says the same thing.
The article says “attackers now begin targeting serious vulnerabilities with exploitation attempts an average of three days after they’re disclosed. Seventy-one percent of the observed exploit attempts occurred within the first seven days”
The source says “That's the average time between a new high-severity vulnerability going public and someone using it against somebody else. Not three weeks. Not "at the next change window." Three days. And…”
Source cited by the article: rapid7.com/research/report/quarterly-threat-landscape-report
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN —
Recorded for context only, checked 29 Oct 2026, 05:47 UTC. It played no part in the ranking.