Adobe Commerce Poly Shell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges
Summary: CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog on Tuesday: CVE-2026-48356, known as PolyShell, which Sansec says attackers used to breach hundreds of e-commerce stores and inject a malicious loader via a Magento CMS block, and CVE-2026-111497, a Brotli decoder flaw also called Broccoli2Shell, HTTP2Shell, and Node2Shell. Previdian recorded one exploitation attempt against its honeypots from a U.S.-based IP as of October 27, 2026, while ELLIO reported exploit traffic from a Netherlands IP, 94.154.43[.]7, carrying a working Node2Shell exploit for node v24.22.0.
Why it matters: Wiz reports 91% of cloud environments have resources vulnerable to CVE-2026-111497 and 82% have publicly exposed Node.js instances, and FCEB agencies have until November 10, 2026 to patch - a deadline that leaves little room for the many vendors still shipping fixes.
Read the original at The Hacker News ↗
- Topics
- Detection & Response
- Mentions
- CVE-2026-111497CVE-2026-48356
- Related
- CISA Adds Two Known Exploited Vulnerabilities to Catalog Cyber Risks · Oct 27, 2026Siemens Industrial Edge Management Cyber Risks · Nov 12, 2026Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026