Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

CISA has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-48356, a file-upload flaw in Adobe Commerce and Magento (CVSS 9.2) nicknamed PolyShell, and CVE-2026-111497, a memory-corruption bug in Google's Brotli decoder library (CVSS 9.3) also called Broccoli2Shell, HTTP2Shell, or Node2Shell. Researchers at Sansec previously reported attackers abusing CVE-2026-48356 to compromise hundreds of e-commerce stores by planting a loader inside a Magento CMS block, with the campaign believed active since at least July 2025, though no final payload has been identified yet. The Brotli flaw is far more widespread, affecting Node.js, Bun, PHP, .NET, Envoy Proxy, Istio, Python, ClickHouse and other projects that rely on the library, with ELLIO and Previdian confirming real-world exploit traffic including a working remote-shell exploit against Node.js v24.22.0. Wiz estimates that 91% of cloud environments contain resources vulnerable to CVE-2026-111497, and federal agencies have been ordered to remediate both issues by November 10, 2026.