{"id":3852,"date":"2026-10-28T22:14:31","date_gmt":"2026-10-28T22:14:31","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3852"},"modified":"2026-10-28T22:14:31","modified_gmt":"2026-10-28T22:14:31","slug":"adobe-commerce-polyshell-attacks-breach-hundreds-of-stores-as-brotli-exploit-traffic-emerges","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3852","title":{"rendered":"Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges"},"content":{"rendered":"<div>\n<p><span class=\"p-author\"><i class=\"icon-font icon-user\">\ue804<\/i><span class=\"author\">Ravie Lakshmanan<\/span><i class=\"icon-font icon-calendar\">\ue802<\/i><span class=\"author\">Oct 28, 2026<\/span><\/span><span class=\"p-tags\">Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n<div id=\"articlebody\">\n<div class=\"separator\" style=\"clear: both;\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEj1vdoV4q9cDhhxBpH2lDPkUPc4WTkuwSmH93IS6MDM8fSYR4ZsKEakfK54cvOjHMFYGJA7Hri87MShqbPweb0BNmEXEsKJErbferZyq7_m7XdHLrb2bgmps_Bs_nu_w7RCiade8PPKSYv6NpxnWTG8pJD5CIUvI2E_cfWMqNBFTl4MXm2WKZaqL_T0DaO-\/s1700-nu-rw-lo-l85-e365\/cisa-warning.jpg\" style=\"display: block;  text-align: center; clear: left; float: left;\"><\/a><\/div>\n<p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday <a href=\"https:\/\/www.cisa.gov\/news-events\/alerts\/2026\/10\/27\/cisa-adds-two-known-exploited-vulnerabilities-catalog\" target=\"_blank\">added<\/a> two vulnerabilities impacting Adobe Commerce and Magento, and Google&#8217;s Brotli decoder library to its Known Exploited Vulnerabilities (<a href=\"https:\/\/www.cisa.gov\/known-exploited-vulnerabilities-catalog\" target=\"_blank\">KEV<\/a>) catalog, citing evidence of active exploitation.<\/p>\n<p>The vulnerabilities are listed below &#8211;<\/p>\n<ul>\n<li><strong><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-111497\" target=\"_blank\">CVE-2026-111497<\/a><\/strong> (CVSS score: 9.2) &#8211; An unchecked return value vulnerability in Google Brotli that could allow a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial-of-service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.<\/li>\n<li><strong><a href=\"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-48356\" target=\"_blank\">CVE-2026-48356<\/a><\/strong> (CVSS score: 9.3) &#8211; An unrestricted upload of a file with dangerous type vulnerability in Adobe Commerce and Magento that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim&#8217;s account or session.<\/li>\n<\/ul>\n<p>The development comes days after Sansec said it observed attackers leveraging CVE-2026-48356, also known as PolyShell, to breach hundreds of e-commerce stores to inject a malicious loader via a Magento CMS block.<\/p>\n<p>The loader is designed to fetch and execute an attacker-controlled payload, although no next-stage malware has been recovered to date, making it challenging to determine what the exact goals of the campaign are. The activity is assessed to be ongoing since at least July 2025.<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/ai-security-guide-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgasUea1PyqjHgZ4PrtmNHQRiRuIWuKqadF1Y1kDkBQlmLoAduaR0D2D5_AgqPzyreZSALvgtryBe5zD3YTk_Q65XX762OpyZGzSzGT8nzn5QlFoiKE6Dqq8rZUJm2Sn_3-epxU4vcpXR-a9JZKHBO4Bq9_nIlpaEEgDZ0oMEEDi4q9NmkHkHuZofDor0TO\/s728-nu-rw-lo-l85-e365\/nudge-2-d.png\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>As for CVE-2026-111497 (aka Broccoli2Shell, HTTP2Shell, and Node2Shell), telemetry data from threat intelligence firm Previdian <a href=\"https:\/\/previdian.com\/CVE-2026-111497#telemetry\" target=\"_blank\">shows<\/a> that one exploitation attempt has been recorded against its honeypot sensors from a U.S.-based IP address as of October 27, 2026. It&#8217;s currently not known if these efforts are broad in scope.<\/p>\n<p><a name=\"more\"\/><\/p>\n<p>\u00abAn attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory,\u00bb Rapid7 <a href=\"https:\/\/www.rapid7.com\/blog\/post\/etr-cve-2026-111497-critical-out-of-bounds-write-in-the-node-js-brotli-decoder\/\" target=\"_blank\">said<\/a>. \u00abAccording to Node.js, this corruption can lead to a process crash, disclosure of sensitive process memory, or remote code execution. Exposure therefore depends on whether an application passes attacker-controlled compressed data to the affected decoder.\u00bb<\/p>\n<p>ELLIO also <a href=\"https:\/\/ellio.tech\/en\/blog\/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds\/\" target=\"_blank\">reported<\/a> on Monday that its sensors \u00abhave recorded CVE-2026-111497 exploit traffic in the wild, carrying the public exploit that we confirmed gets a shell on vulnerable builds.\u00bb The activity originates from \u00ab<a href=\"https:\/\/viz.greynoise.io\/ips\/94.154.43.7\" target=\"_blank\">94.154.43[.]7<\/a>,\u00bb an IP address geolocated to the Netherlands that has also engaged in exploitation efforts targeting PHP2Shell, <a href=\"https:\/\/gambit.security\/blog-posts\/php2shell-shows-the-shrinking-time-to-patch\" target=\"_blank\">two critical flaws in PHP<\/a> that could result in <a href=\"https:\/\/www.trellix.com\/blogs\/research\/php2shell-key-info-on-cve-2026-109618-and-cve-2026-109619\/\" target=\"_blank\">unauthenticated remote code execution<\/a>.<\/p>\n<p>\u00abThe attacker&#8217;s payload is a genuine, correctly-structured Node2Shell exploitation attempt for node v24.22.0 \u2013 the Brotli stream, staged displacement, pivot pair, and delivery are all correct and identical to the public tooling,\u00bb ELLIO said. \u00abThis is indicative of the RCE being adopted by an operator focused on mass exploitation.\u00bb<\/p>\n<p>The fact that Brotli is a <a href=\"https:\/\/broccoli2shell.com\/\" target=\"_blank\">widely distributed open-source library<\/a> and adopted by numerous projects has provoked an emergency response, prompting various vendors to release patches or assess if their products are affected by the flaw.<\/p>\n<p>This includes PHP, which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby \u00abbrotli\u00bb gem. Links to some of the advisories are below &#8211;<\/p>\n<p>\u00abNode.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1,\u00bb Akamai <a href=\"https:\/\/www.akamai.com\/blog\/security-research\/inside-node2shell-closer-look-cve-2026-111497\" target=\"_blank\">said<\/a>. \u00abThe Node.js advisory does not offer a workaround, so upgrading is the only complete remediation. Organizations running a discontinued release line should move to a supported release line.\u00bb<\/p>\n<div class=\"dog_two clear\">\n<div class=\"cf\"><a href=\"https:\/\/thehackernews.uk\/network-defense-d\" rel=\"nofollow noopener sponsored\" target=\"_blank\"><img loading=\"lazy\" decoding=\"async\" class=\"lazyload\" alt=\"Cybersecurity\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVV2rRkX8tRMF6gCzemvQNpwFwGxRWxY1cJEYfoLLSj1EZYJOlj5WTR77t0i6kELXujYcaHTpRDqTjCbVHH5Pnh7wzxUiKP5j4dsDkWIMlp2bmpZsL0jeAsA_19pHH5UPtyBvNkZdyGEULOAsXPcraMP5CYjQRFefhXRSdEjYkrdcpUnc4ILcvcdEfAauE\/s728-nu-rw-lo-l85-e365\/tl-d.jpg\" width=\"729\" height=\"91\"\/><\/a><\/div>\n<\/div>\n<p>Google-owned Wiz has <a href=\"https:\/\/www.wiz.io\/blog\/cve-2026-111497-brotli-rce-node-js\" target=\"_blank\">warned<\/a> that \u00ab91% of cloud environments have resources vulnerable to CVE-2026-111497 and 82% of cloud environments have publicly exposed Node.js instances.\u00bb<\/p>\n<p>\u00abNode2Shell is not a bug in every Node.js service, but a bug in services that decode attacker-influenced Brotli,\u00bb Sysdig <a href=\"https:\/\/www.sysdig.com\/blog\/node2shell-cve-2026-111497-detecting-the-node-js-brotli-rce\" target=\"_blank\">said<\/a>. \u00abExpress 5 with default JSON parsing puts a large number of instances of them in that group. The demonstrated impact thus far is crashes at scale and code execution in a narrow configuration, so patch order should follow reachability.\u00bb<\/p>\n<p>Federal Civilian Executive Branch (FCEB) agencies have time until November 10, 2026, to apply the necessary fixes against the two flaws.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>\ue804Ravie Lakshmanan\ue802Oct 28, 2026Vulnerability \/ Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google&#8217;s Brotli decoder library&hellip;<\/p>\n","protected":false},"author":1,"featured_media":3853,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1135,24,278,3890,3011,1126,120,1636,794,193,1267],"class_list":["post-3852","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-adobe","tag-attacks","tag-breach","tag-brotli","tag-commerce","tag-emerges","tag-exploit","tag-hundreds","tag-polyshell","tag-stores","tag-traffic"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3852","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3852"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3852\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3853"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3852"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3852"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3852"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}