Online Store Platforms Under Attack: Adobe Commerce Breaches and a New Brotli Flaw Prompt Urgent Warnings

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities affecting Adobe Commerce and Magento, plus a flaw in Google's Brotli decoder library, to its Known Exploited Vulnerabilities catalogue. The listing cites evidence of active exploitation. It follows a report from security firm Sansec that attackers used a flaw known as PolyShell (CVE-2026-48356) to breach hundreds of e-commerce stores. They injected a malicious loader through a Magento CMS block, designed to fetch and run attacker-controlled code. No follow-on malware has been recovered, so the campaign's goals remain unclear. The activity is assessed to have been running since at least July 2025.

The Brotli flaw, CVE-2026-111497, is also known as Broccoli2Shell, HTTP2Shell and Node2Shell. Rapid7 explained that an attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory. According to Node.js, this can cause a crash, expose sensitive memory, or allow remote code execution. Whether a business is exposed depends on whether its application passes attacker-controlled compressed data to the affected decoder.

Security firm ELLIO reported exploit traffic in the wild from an IP address in the Netherlands that has also targeted PHP flaws, suggesting an operator focused on mass exploitation. Because Brotli is a widely used open-source library, vendors are releasing patches or checking whether their products are affected.