Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

The evidence points to a broad and uneven threat. Sansec observed attackers exploiting PolyShell, or CVE-2026-48356, to breach hundreds of e-commerce stores. The attackers injected a loader through Magento CMS blocks. That loader could fetch and execute an attacker-controlled payload, although no next-stage malware has been recovered.

Brotli exposure is potentially much larger because the library appears in many products. Google-owned Wiz reported that 91% of cloud environments have resources vulnerable to CVE-2026-111497, while 82% have publicly exposed Node.js instances. Those figures indicate substantial potential exposure, not confirmed compromise of every environment.

Actual exploitation evidence is more limited for Broccoli2Shell. Previdian recorded one attempt against its honeypots from a U.S.-based IP address by October 27, 2026. ELLIO also saw public exploit traffic from a Netherlands-based address and assessed it as mass-exploitation activity. The campaign's full scope is still unknown.

PolyShell abuses unrestricted uploads of dangerous file types in Adobe Commerce and Magento. Successful exploitation can execute arbitrary code in the current user's context. That may give attackers elevated access or control over the victim's account or session. Sansec saw attackers use the flaw to inject a malicious loader through a Magento CMS block.

The loader was designed to fetch and execute an attacker-controlled payload. No next-stage malware has been recovered, so the campaign's precise objectives remain unclear. Broccoli2Shell is different: a crafted Brotli stream can corrupt adjacent decoder-state memory. That corruption may disclose sensitive memory contents, crash the process, or potentially enable arbitrary code execution.

The practical impact depends on the vulnerable software's configuration and exposure. Node.js applications are at risk when they pass attacker-controlled compressed data to the affected decoder. ELLIO reported a public exploit that obtained a shell on vulnerable builds, while other observed activity demonstrated crashes and possible remote code execution.

Broccoli2Shell is a flaw in Brotli decoding, not a universal failure in every Node.js service. A service becomes relevant when it accepts or receives Brotli-compressed data that an attacker can influence. The application then passes that data to the affected decoder, creating the path needed to trigger memory corruption.

Rapid7 explained that an attacker who supplies Brotli data processed with node:zlib can corrupt process memory. Sysdig similarly noted that Node2Shell affects services decoding attacker-influenced Brotli. Express 5 with default JSON parsing places many instances in that category, but the article does not say every Express or Node.js deployment is vulnerable.

This distinction changes how teams should prioritize fixes. Organizations need to assess reachability, including whether untrusted compressed input reaches the decoder. Wiz found many potentially vulnerable cloud resources and exposed Node.js instances, but those figures do not prove exploitation or vulnerability in every service. Node.js fixed the issue in versions 22.23.4, 24.22.1, and 26.12.1.

Several independent observations show exploitation beyond laboratory discussion. CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation. Sansec reported that attackers had used PolyShell against hundreds of e-commerce stores. The activity has been ongoing since at least July 2025.

For Broccoli2Shell, Previdian recorded an exploitation attempt against honeypot sensors from a U.S.-based IP address by October 27, 2026. ELLIO also reported exploit traffic from 94.154.43[.]7 in the Netherlands. Its sensors captured a correctly structured Node2Shell attempt using the public exploit, which ELLIO said obtained a shell on vulnerable builds.

The observed payload included the expected Brotli stream, staged displacement, pivot pair, and delivery. ELLIO said this indicated adoption by an operator focused on mass exploitation. The campaign's overall breadth remains uncertain, but these observations demonstrate real attacks, not only theoretical risk. CISA also imposed a November 10, 2026, remediation deadline for FCEB agencies.

The Brotli flaw has triggered a wide vendor response because the library is embedded in many projects. Node.js, PHP, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby brotli gem are among the affected or assessing technologies. Vendors and security companies have published advisories, patches, or exposure guidance.

Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1. PHP shipped several fixed package versions, including 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1. Organizations should also examine whether attacker-controlled Brotli data can reach their decoder, because reachability determines practical exposure.

A workaround cannot fully remove the decoder's underlying defect. Akamai reported that the Node.js advisory offers no workaround, making an upgrade the only complete remediation. Organizations using discontinued release lines should move to supported ones. FCEB agencies have until November 10, 2026, to fix both vulnerabilities.

Memory corruption occurs when software writes to or uses memory incorrectly, potentially changing nearby data or control information. Arbitrary code execution means an attacker makes the program run instructions they choose. Remote unauthenticated access means reaching the vulnerable function over a network without first proving an identity. These outcomes are dangerous because they can move from a small parsing mistake to control of a running process.

In Broccoli2Shell, a crafted Brotli stream triggers an unchecked return-value problem and corrupts adjacent decoder-state memory. The article says this can expose sensitive memory, crash the process, or potentially execute code. If the decoder runs inside a server, the affected process may handle application requests and data.

A shared library increases the number of possible entry points because many products reuse it. The article lists Node.js, PHP, Bun, Envoy Proxy, Istio, .NET, Python, and others. Still, exploitation requires the right data path. The attacker must reach a vulnerable decoder with controlled Brotli input, so not every installation is automatically exploitable.