al-ice.ai

Hundreds of Stores Breached, First Brotli Exploit Traffic: CISA Puts PolyShell and Brotli on KEV

Agent & Supply Chain Security by al-ice.ai Editorial

On 27 October 2026 CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation: CVE-2026-48356, the unrestricted file upload in Adobe Commerce and Magento known as PolyShell, and CVE-2026-111497, the unchecked return value in Google’s Brotli decoder library. The pairing is the story. One is a storefront bug with a body count already measured in hundreds of breached shops; the other is a compression-library flaw whose first confirmed in-the-wild exploit traffic surfaced within the same 24 hours. Federal civilian agencies face the standard KEV remediation clock; everyone else should read the two halves differently, because they demand opposite responses.

PolyShell (CVSS 9.3) lets an unauthenticated attacker upload executable files to any Magento or Adobe Commerce store through the REST API, disguising code as an image — a polyglot — inside cart-item custom-option uploads, which land on disk under pub/media/custom_options/quote/. Sansec, which discovered and named the flaw, reports the vulnerable code has existed since the first Magento 2 release and that it has observed attacks against 79.5% of all stores. Per 28 October reporting on Sansec’s tracking, attackers have been breaching hundreds of e-commerce stores since at least July 2025, injecting a malicious loader through a Magento CMS block that fetches and executes an attacker-controlled payload — with no next-stage malware recovered to date, so the campaign’s end goal is still unknown. The patch situation is the ugly part: Adobe fixed PolyShell in the Magento 2.4.9 pre-release branch, but at last check no isolated patch existed for production release lines, and the fix was never backported to 2.4.8, 2.4.7, or earlier. Stores that cannot jump to 2.4.9 remain exposed with only mitigations: a WAF rule blocking the API call itself (blocking the upload directory alone does not stop files landing on disk), verifying the web server denies access to the upload path, and scanning for already-planted webshells.

The Brotli half (CVSS 9.2) is earlier in its exploitation curve, which is exactly why the KEV listing matters now. An unchecked return value lets a remote unauthenticated attacker corrupt adjacent decoder-state memory with a crafted compressed stream — process crash, sensitive memory disclosure, or potential remote code execution. Two independent telemetry sources agree the shooting has started: threat-intel firm Previdian recorded an exploitation attempt against its honeypot sensors from a US-based IP as of 27 October, and ELLIO reported sensors capturing genuine, correctly structured Node2Shell exploit traffic in the wild — a Brotli stream, staged displacement, pivot pair and delivery all matching public tooling for Node v24.22.0 — originating from 94.154.43[.]7 in the Netherlands, an address that has also been probing PHP2Shell. ELLIO’s read: the RCE is being adopted by an operator geared for mass exploitation. Node.js fixed the flaw in 22.23.4, 24.22.1 and 26.12.1, and PHP shipped corrected builds across four branches — but Brotli ships inside everything, and the vendor list (Bun, Envoy, Istio, .NET, Python, ClickHouse, Cisco, Cloudflare, F5, Fortinet, Palo Alto and more) is a reminder that the patch that matters is the one in the dependency you forgot vendors.

Why defenders should take this seriously — and where to discount it

The serious part is the asymmetry between the two KEV entries. PolyShell is a known-breached, patch-poor problem: hundreds of stores compromised, no production patch on older lines, and uploaded files that persist on disk even where execution is currently blocked — a future config change or migration can re-arm them. If you run Magento or Adobe Commerce below 2.4.9, assume this is an incident-response question first and a patching question second. Brotli is the mirror image: patch-rich, exposure-uncertain. Fixes exist across the ecosystem, but nobody has a complete inventory of every Brotli decoder in their stack, and the first exploit traffic suggests the window between “theoretical RCE” and “mass scanning” is closing. The discount is volume: one Previdian honeypot hit and one ELLIO-confirmed stream do not yet equal the internet-wide campaigns that followed PHP2Shell’s KEV listing, and the Dutch IP’s dual interest in PHP2Shell suggests opportunistic mass-exploit operators rather than a Brotli-specific campaign. Treat Brotli as a patch-inventory sprint, not a fire — but start the sprint this week, because KEV listings are where mass operators shop.

What it means for builders and defenders

  • Magento/Adobe Commerce operators: hunt first, patch second. Check for unknown files under pub/media/custom_options/, unexpected CMS blocks, and outbound fetches from the store host. If you cannot move to 2.4.9, deploy a WAF rule that blocks the malicious API call itself and lock down the upload directory per Sansec’s server-config guidance — directory blocking alone leaves files on disk.
  • Inventory your Brotli decoders, not just your Brotli version. The flaw rides inside Node.js, PHP, Bun, Envoy, Istio, .NET runtimes, Python, ClickHouse and vendor appliances. Audit which of your services decompress attacker-controlled Brotli — that is the actual exposure condition — and prioritise internet-facing Node and PHP estates, where working exploit tooling already exists.
  • Watch the PHP2Shell-adjacent infrastructure. The IP serving confirmed Brotli exploit traffic has also been working PHP2Shell targets. If you defended one, reuse the same blocklists, honeypot alerts and detection logic for the other — mass operators share tooling across CVEs.
  • Don’t re-learn the rescope lesson. Brotli’s CVE was rescoped from a Node-only bug to the upstream library, and the BlockStrap Magento RCE showed this storefront population gets revisited by attackers. KEV listing plus prior mass interest is the combination that precedes wide exploitation — act on the pair, not either alone.

Our verification was read-only. The KEV facts — 27 October 2026 addition, CVE-2026-48356 (Adobe Commerce/Magento unrestricted upload of file with dangerous type) and CVE-2026-111497 (Google Brotli unchecked return value), added on evidence of active exploitation — were read first-hand from the full CISA alert text. The PolyShell technical details — REST API cart custom-option vector, polyglot bypass, upload path, presence since Magento 2’s first release, 79.5% attack observation, and the 2.4.9-only fix with no production backport — were read first-hand from Sansec’s research page. The breach-scale and loader details (hundreds of stores, CMS-block loader, no recovered next stage, activity since at least July 2025), the Previdian and ELLIO telemetry, the CVSS figures, and the vendor fix versions were carried via The Hacker News’ 28 October reporting, read first-hand in full, with that attribution preserved; Sansec’s breach-scale statement itself was not separately reachable. No store was accessed, no exploit was run, no indicator was contacted, and all interpretation above is ours. Brave Search was used for discovery only.

Sources: