Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

CISA Flags PolyShell and Brotli Flaws as Actively Exploited as Hundreds of Magento Stores Are Breached

CISA has added a Magento file-upload flaw and a Brotli decoder bug to its KEV catalog. Hundreds of stores already carry a malicious loader, and Brotli exploit traffic is live.

4T4Tify Team4Tify
Oct 28, 2026·6 min read
CISA Flags PolyShell and Brotli Flaws as Actively Exploited as Hundreds of Magento Stores Are Breached

CISA Flags PolyShell and Brotli Flaws as Actively Exploited as Hundreds of Magento Stores Are Breached

Two critical vulnerabilities landed on CISA's Known Exploited Vulnerabilities (KEV) catalog on 27 October 2026, and both are already being used in real attacks. One is a file-upload flaw in Adobe Commerce and Magento that criminals have used to compromise hundreds of online shops. The other sits inside Brotli, the compression library that ships with Node.js, PHP, .NET, Python and dozens of other products, and exploit traffic for it has started hitting internet sensors.

What happened

CISA added the two entries after confirming evidence of exploitation in the wild. Federal civilian agencies in the United States must patch both by 10 November 2026, but the deadline is a useful yardstick for everyone else too: when a bug reaches KEV, attackers are already using it.

CVE-2026-48356, "PolyShell" (CVSS 9.3)

This is an unrestricted file upload of a dangerous file type in Adobe Commerce and Magento. A successful attack leads to arbitrary code execution in the context of the current user and can hand the attacker elevated access or control over a victim's account or session.

In practice, the flaw is being used at scale. Attackers have broken into hundreds of e-commerce stores and planted a malicious loader inside a Magento CMS block, the content widget that merchants use for banners and promotional text. The loader reaches out to attacker-controlled infrastructure and pulls down a second-stage payload. No follow-on malware has been recovered yet, so the ultimate goal of the campaign is still unclear, although card-skimming and credential theft are the usual endgame on compromised storefronts. The activity appears to have been running since at least July 2025.

CVE-2026-111497, "Node2Shell" (CVSS 9.2)

Also tracked under the names Broccoli2Shell and HTTP2Shell, this is an unchecked return value bug in Google's Brotli decoder. A remote, unauthenticated attacker who can feed a crafted Brotli-compressed stream to a vulnerable application can corrupt adjacent decoder state in memory. Depending on the target, that means a crash, a leak of sensitive process memory, or remote code execution.

Exploitation is no longer theoretical. Honeypot telemetry has recorded an exploitation attempt from a US-based address as of 27 October, and separate sensors have captured live exploit traffic from a Netherlands-hosted IP, 94.154.43[.]7, that is also probing for the two PHP2Shell remote code execution bugs in PHP. The captured payload is a correctly built Node2Shell exploit for Node.js 24.22.0, identical to the public tooling, which points to an operator gearing up for mass exploitation rather than a one-off test.

Why it matters

Brotli is everywhere. Because the library is embedded in so many runtimes and products, the flaw triggered an unusually wide emergency response. Patched releases are now available for Node.js (22.23.4, 24.22.1 and 26.12.1), PHP (8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1), Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension and the Ruby brotli gem, and vendors from Cisco, Cloudflare and F5 to Fortinet, Palo Alto Networks, Red Hat, Ubuntu and Microsoft have published advisories.

Cloud telemetry published this week suggests that roughly nine in ten cloud environments contain at least one resource exposed to CVE-2026-111497, and more than eight in ten have Node.js instances reachable from the internet. There is no workaround for Node.js: upgrading is the only complete fix, and anyone still on a discontinued release line needs to move to a supported one.

That said, the risk is not uniform. Node2Shell only bites services that decompress Brotli data an attacker can influence. Express 5 with default JSON body parsing puts a large share of Node.js apps in that bucket, so reachability, not just version numbers, should drive your patch order. The demonstrated impact so far is crashes at scale and code execution in narrower configurations.

For Magento operators the picture is simpler and worse: the exploit is cheap, the store is public by definition, and the payload is already being planted.

What to do

  • Patch Adobe Commerce and Magento now. Apply Adobe's fix for CVE-2026-48356 on every production and staging instance.
  • Hunt for the loader. Review all CMS blocks, widgets and recently modified static content for unfamiliar script tags or obfuscated JavaScript, and check the admin audit log for unexpected changes since July 2025.
  • Inventory your Brotli exposure. List every service that uses Node.js, PHP, Bun, .NET, Python, Envoy, Istio or ClickHouse and upgrade to the fixed releases listed above. Rebuild containers so the patched runtime actually ships.
  • Prioritise by reachability. Internet-facing services that accept compressed request bodies, especially Express 5 APIs, go first.
  • Block and watch. Add 94.154.43[.]7 to your blocklists and alert on malformed Brotli streams hitting your edge.
  • Verify, don't assume. A dependency manifest is not proof that the fixed binary is actually running.

Flaws like these show why the gap between a public exploit and a patched fleet needs to be measured in hours, not weeks. Continuous vulnerability scanning of your exposed storefronts and API hosts, the kind our team runs for clients, flags outdated Magento builds and vulnerable runtimes before the next mass-exploitation wave reaches them.

SHARE