"An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory," Rapid7 said.
PolyShell (CVE-2026-48356): hundreds of Magento and Adobe Commerce stores breached
CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog after security researchers documented active exploitation. CVE-2026-48356, scored 9.3, is described as "an unrestricted upload of a file with dangerous type" in Adobe Commerce and Magento that can allow arbitrary code execution in the context of the current user. Sansec reported that attackers have leveraged this flaw — known publicly as PolyShell — to breach hundreds of e-commerce stores by injecting a malicious loader into a Magento CMS block.
The injected loader is designed to fetch and execute an attacker-controlled payload. To date, researchers have not recovered a definitive next-stage malware sample, which leaves the campaign's ultimate objectives unclear. Sansec's timeline places activity as ongoing since at least July 2025.
CVE-2026-111497 (Node2Shell / Broccoli2Shell / HTTP2Shell): exploit traffic and sensor reports
CISA added CVE-2026-111497 to its KEV catalog as well. The vulnerability, assigned a CVSS score of 9.2, is an unchecked return value bug in Google's Brotli decoder that can allow a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause denial-of-service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Telemetry and sensor reports show varying levels of exploitation activity. Threat intelligence firm Previdian recorded one exploitation attempt against its honeypot sensors from a U.S.-based IP address as of October 27, 2026. ELLIO reported recording exploit traffic originating from 94.154.43[.]7 — an IP geolocated to the Netherlands — that carried a public exploit which "we confirmed gets a shell on vulnerable builds." ELLIO added that the payload observed was "a genuine, correctly-structured Node2Shell exploitation attempt for node v24.22.0" and said the delivery looked "identical to the public tooling," a pattern it described as indicative of an operator focused on mass exploitation.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadVendors, patches, and the emergency response
Because Brotli is a widely distributed open-source library adopted by many projects, the response has been broad and urgent. The source lists advisories or releases from numerous vendors and projects including Node.js, PHP, .NET, Envoy Proxy, Istio, Python, ClickHouse, Ruby, and many commercial vendors and platforms. The article notes that PHP shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 addressing the issue.
Akamai highlighted Node.js fixes in specific releases — 22.23.4, 24.22.1, and 26.12.1 — and stressed that upgrading is the only complete remediation because the Node.js advisory did not offer a workaround. Several commercial vendors and platform providers are listed as having advisories or mitigations under way, including Amazon Linux, Bun, Cisco, Cloudflare, CloudLinux, Envoy Proxy, F5, Fortinet, Imperva, Istio, Microsoft Azure, Microsoft .NET, Palo Alto Networks, Qualys, Red Hat, Strapi, Tenable, Ubuntu, and others named in vendor lists.
What this means for technologists, Federal Civilian Executive Branch (FCEB) agencies, and cloud operators
- Technologists and security teams: Systems that decode attacker-influenced Brotli streams are at particular risk; Sysdig highlighted Express 5 with default JSON parsing as an example that increases reachability. Where Node.js or other runtimes are running vulnerable Brotli decoders, remediation prioritization should follow service reachability and exposure.
- FCEB agencies: CISA's action places both CVE-2026-48356 and CVE-2026-111497 on the KEV catalog and gives Federal Civilian Executive Branch agencies a compliance window — agencies have until November 10, 2026, to apply the required fixes.
- Cloud operators and owners of public-facing Node.js instances: Wiz warned that "91% of cloud environments have resources vulnerable to CVE-2026-111497 and 82% of cloud environments have publicly exposed Node.js instances," signaling a high potential attack surface in cloud deployments that must be assessed and patched quickly.
Four connected realities emerge from the record: a high-severity file-upload flaw is already enabling mass compromise of web storefronts, a widely used compression library presents a separate and rapidly spreading risk, vendors and platforms have issued patches but patching is the only complete remedy in some runtimes, and federal agencies face a near-term deadline. The public evidence — honeypot hits, sensor captures, and vendor advisories — points to an active, multi-vector problem that security teams and system owners cannot afford to ignore.
