LOKI INTELLIGENCE

Loki Intelligence — Security Briefs · Published

Daily Security Brief: Magento and Brotli KEV Additions, GMO Ransomware Threat

Actively exploited flaws in Adobe Commerce/Magento, Google Brotli, PHP and Apple CoreGraphics lead today's picture, alongside a vendor breach touching AI agent logs. Teams should prioritize patching KEV-listed and exploited issues, then review third-party vendor exposure and ICS advisories where relevant.

Signal 01 · CISA

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two vulnerabilities to its KEV Catalog based on evidence of active exploitation: an unrestricted file upload issue in Adobe Commerce and Magento (CVE-2026-48356) and an unchecked return value issue in Google Brotli (CVE-2026-111497).

Why it matters: Web shops running Adobe Commerce or Magento, and any product bundling Brotli, should treat these as priority patching and inventory items since exploitation is confirmed.

Source: CISA

Signal 02 · CISA

Mitsubishi Electric and Mitsubishi Electric Iconics Digital Solutions GENESIS, GENESIS64, ICONICS Suite, Hyper Historian, AnalytiX, MobileHMI, IoTWorX, MC Works64, GENESIS32 and BizViz

A CISA ICS advisory covers Mitsubishi Electric and Iconics products such as GENESIS64 and MC Works64, with flaws that could enable arbitrary code execution, authentication bypass or unauthorized operations (CVE-2023-4863, CVE-2026-16436, CVE-2026-16437, CVE-2026-16438).

Why it matters: Organizations running these industrial platforms should consult the advisory, apply vendor fixes and keep the systems off untrusted networks.

Source: CISA

Signal 03 · BleepingComputer

Japan's GMO urges customers to shut down PCs amid ransomware threat

GMO Group asked customers to disconnect systems from the internet and shut down computers after an intruder who breached its Onamae Desktop Cloud threatened a ransomware attack.

Why it matters: Providers of hosted desktop or cloud services should have tested incident communication and isolation plans, and customers should know how to disconnect and restore from offline backups.

Source: BleepingComputer

Signal 04 · BleepingComputer

Warp discloses breach exposing AI agent logs, user telemetry data

Warp disclosed that agent decision logs and telemetry data from users of its agentic development environment were exposed through an attack on a third-party vendor in its infrastructure.

Why it matters: AI-agent builders should minimize sensitive content in logs and telemetry, and assess what vendors can access; authorized testing of agents and APIs can help review such exposure paths.

Source: BleepingComputer

Signal 05 · The Hacker News

Apple Backports Fix for Exploited CoreGraphics Flaw to Older iPhones and iPads

Apple backported a fix to older iPhones and iPads for CVE-2026-86950, a high-severity (CVSS 8.8) out-of-bounds write in CoreGraphics that was exploited in real-world attacks and could lead to arbitrary code execution.

Why it matters: Teams managing mobile fleets should push the update to older devices and verify compliance through device management.

Source: The Hacker News

Signal 06 · CISA

CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two PHP flaws to the KEV Catalog, a memory corruption issue (CVE-2026-109618) and a stale internal request-state issue (CVE-2026-109619), and updated its PHP alert calling for immediate patching.

Why it matters: Anyone running PHP-based applications should confirm runtime versions and patch promptly, including embedded or containerized PHP.

Source: CISA

Signal 07 · CISA

EPICS Base

A CISA ICS advisory on EPICS Base releases up to 7.0.10 describes vulnerabilities that could cause denial of service, memory corruption, information disclosure or potentially code execution.

Why it matters: Operators of EPICS-based control systems should review affected versions, apply available updates and limit network exposure.

Source: CISA

Brief sources

Related briefs

Relevant Loki service: Orvyn — AI agent security private preview.