US warns of two serious security flaws being exploited in attacks

CISA added two severe vulnerabilities to its KEV catalog, signaling that both flaws are being exploited and deserve urgent attention. One is CVE-2026-111497 in Google Brotli, a compression library used by many applications and services. The other is CVE-2026-48356 in Adobe Commerce and Magento, platforms used by online stores.

The Brotli flaw can affect applications that process data supplied by attackers. The Adobe Commerce and Magento flaw involves unrestricted file uploads. Attackers can use those uploads to place malicious code on a store and potentially reach user accounts or sessions.

The risks extend beyond individual products. Brotli is embedded across a broad software ecosystem, prompting updates from Node.js, PHP, Python, .NET, Bun, Envoy Proxy, Istio, and others. PolyShell has reportedly compromised hundreds of stores since July 2025, while security firms have observed exploit traffic targeting the Brotli issue.

A software vulnerability is a weakness in a program that can let an attacker cause behavior the developers did not intend. It matters because software often processes data or files supplied by users, including people who may be malicious. The article describes two different weaknesses with potentially serious results.

In Brotli, a compression-processing flaw can corrupt memory when an application handles maliciously supplied data. That corruption may crash the system or, in some cases, allow remote code execution. In Adobe Commerce and Magento, the weakness is an ability to upload files without necessary restrictions. Attackers can insert malicious code through specific content points.

The consequences depend on the affected application and how it handles the flaw. Brotli’s broad use makes the issue relevant to many services, while PolyShell uses the store-platform weakness to infect online shops with additional programs. The article reports hundreds of compromised stores since July 2025.

The exposure spans both retail websites and cloud infrastructure. Security researchers report that PolyShell has compromised hundreds of online stores since July 2025. The campaign targets Adobe Commerce and Magento, inserting malicious code through specific content points and infecting stores with additional programs.

The Brotli problem appears even broader because the library is used by many applications and services. Wiz estimates that the vast majority of cloud computing environments have affected resources. It also reports that a significant percentage maintain publicly exposed Node.js installations, which can increase concern when those installations process attacker-controlled data.

The article does not provide exact percentages for cloud exposure or public Node.js systems. It does provide a clear scale signal: many cloud environments contain affected resources, and hundreds of stores have reportedly been compromised. The range of emergency updates shows how widely the underlying library is embedded.

The two vulnerabilities create different paths to harm. The Brotli issue affects how applications process compressed data. Malicious input may corrupt memory, which can make a system crash or, in the most serious scenario described, allow an attacker to execute code remotely.

The Adobe Commerce and Magento flaw begins with file uploads that lack necessary restrictions. Attackers can place malicious code through specific content points on a store platform. Researchers call this activity PolyShell. The inserted code is intended to infect stores with additional programs and may help attackers reach user accounts or sessions.

The article does not say that every exploit produces every possible outcome. It presents these as potential consequences of successful exploitation. Because Brotli is widely used, the impact can extend across many applications and services. Because Commerce and Magento power online stores, the second flaw can threaten both store operations and customer sessions.

The article identifies activity and monitors rather than naming a specific criminal group. Researchers call the Adobe Commerce and Magento campaign PolyShell and report that its perpetrators have compromised hundreds of online stores since July 2025. The attackers insert malicious code into specific content points on the platforms.

For the Brotli issue, security firms detected web traffic attempting exploitation. The observed attempts came from IP addresses in the United States and the Netherlands, among other locations. The article does not identify the operators behind those attempts or say that they are the same people behind PolyShell.

Several organizations contribute different kinds of visibility. CISA added both vulnerabilities to its KEV catalog. Wiz estimated cloud exposure and public Node.js installations. Security firms monitored hostile traffic. Together, these reports show active exploitation and broad exposure, but the source does not name individual attackers or provide attribution.

Brotli is not limited to one product. It is a widely used data-compression tool that appears inside many applications and services. When a shared library has a security weakness, every product that includes or relies on the affected code may need to assess its exposure and release a fix.

The article lists PHP, Node.js, Bun, Envoy Proxy, Istio, .NET, Python, and other developers and providers as responding with updates. Node.js fixed the issue in versions 22.23.4, 24.22.1, and 26.12.1. These updates address the library problem within each project’s software ecosystem.

This coordinated response reflects the flaw’s reach, not separate vulnerabilities in every listed product. Applications that process data sent by malicious users could inherit the risk through Brotli. Updating the host product helps prevent the memory corruption, crashes, or possible remote code execution described in the article.

Data compression reduces the size of information so applications and services can store or transfer it more efficiently. A compression library performs the technical work of encoding and decoding that information. Brotli is one such library, and the article describes it as widely used worldwide.

The security risk appears when an application processes compressed data supplied by a malicious user. A specially crafted input can trigger the Brotli flaw and corrupt memory. That may crash the application or potentially let an attacker execute code remotely. The danger is not limited to a standalone Brotli tool if other products use the library internally.

This shared foundation explains the broad update response. Node.js, PHP, Python, .NET, Bun, Envoy Proxy, Istio, and others released fixes. Wiz also found affected resources across the vast majority of cloud environments. The article’s lesson is that a low-level weakness can spread risk across many services.