INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Adobe Commerce PolyShell Exploit Targets Hundreds of Stores via Brotli

| 2026-10-28 05:42 MEDIUM HIGH DATA BREACH EXPLOITED VULNERABILITY
JSON
Executive Summary
AI-generated
On October 28, 2026, hundreds of Adobe Commerce and Magento stores were breached due to exploitation of two critical vulnerabilities: CVE-2026-111497 (CVSS score: 9.2) in Google Brotli decoder library and CVE-2026-48356 (CVSS score: 9.3) in Adobe Commerce and Magento, which could result in arbitrary code execution. The activity originates from an IP address geolocated to the Netherlands, 94.154.43[.]7, that has also engaged in exploitation efforts targeting PHP2Shell. This attack is ongoing since at least July 2025, with one recorded exploit attempt against a U.S.-based IP address as of October 27, 2026. The attackers are using a malicious loader to inject an attacker-controlled payload into the stores' Magento CMS blocks, although no next-stage malware has been recovered to date.
Technical Mitigations AI-generated
• Upgrade <a href="/auth/login?next=/detail/JWVohqEBo0ihlvYp5xkz" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a> to version 22.23.4, 24.22.1, or 26.12.1. • Apply patches for PHP versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1 to prevent arbitrary code execution. • Block traffic from IP addresses associated with the exploit attempts (94.154.43[.]7) or implement a web application firewall to detect and block malicious Brotli-compressed streams.
Technical Observables 2 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 2 IoCs Create Free Account
files 1 ips 1
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
CVE-2026-48356CVE-2026-48356 CVE-2026-111497CVE-2026-111497
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎at least July 2025
Threat actors used a Brotli exploit to target Adobe Commerce PolyShell, resulting in hundreds of store breaches that have been ongoing since at least July 2025.
‎October 27, 2026
Threat actors used a Brotli exploit to target vulnerable Node.js instances, including PHP and other services, resulting in hundreds of stores being breached.
vulnerability CVE-2026-111497
As for CVE-2026-111497 (aka Broccoli2Shell, HTTP2Shell, and Node2Shell), telemetry data from threat intelligence firm Previdian shows that one exploitation attempt has been recorded against its honeypot sensors from a U.S.-based IP address as of October 27, 2026.
organisation Node2Shell
As for CVE-2026-111497 (aka Broccoli2Shell, HTTP2Shell, and Node2Shell), telemetry data from threat intelligence firm Previdian shows that one exploitation attempt has been recorded against its honeypot sensors from a U.S.-based IP address as of October 27, 2026.
organisation IP
As for CVE-2026-111497 (aka Broccoli2Shell, HTTP2Shell, and Node2Shell), telemetry data from threat intelligence firm Previdian shows that one exploitation attempt has been recorded against its honeypot sensors from a U.S.-based IP address as of October 27, 2026.
organisation PHP
The activity originates from " 94.154.43[.]7 ," an IP address geolocated to the Netherlands that has also engaged in exploitation efforts targeting PHP2Shell , two critical flaws in PHP that could result in unauthenticated remote code execution .
organisation ELLIO
" ELLIO also reported on Monday that its sensors "have recorded CVE-2026-111497 exploit traffic in the wild, carrying the public exploit that we confirmed gets a shell on vulnerable builds."
organisation CVE-2026
" ELLIO also reported on Monday that its sensors "have recorded CVE-2026-111497 exploit traffic in the wild, carrying the public exploit that we confirmed gets a shell on vulnerable builds."
organisation Wiz
" Google-owned Wiz has warned that "91% of cloud environments have resources vulnerable to CVE-2026-111497 and 82% of cloud environments have publicly exposed Node.js instances.
organisation Node.js
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
infrastructure 8.5.12-1
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
infrastructure 8.4.27-1
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
infrastructure 8.3.36-1
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
infrastructure 8.2.35-1
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
organisation Bun
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
organisation ClickHouse
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
organisation PHP Brotli
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
financial 1 PHP
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
infrastructure 22.23.4
Links to some of the advisories are below - "Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1," Akamai said .
infrastructure 24.22.1
Links to some of the advisories are below - "Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1," Akamai said .
infrastructure 26.12.1
Links to some of the advisories are below - "Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1," Akamai said .
organisation node
"An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory," Rapid7 said .
organisation zlib
"An attacker who can supply Brotli data that an application decompresses with node:zlib can corrupt process memory," Rapid7 said .
organisation node v24.22.0
"The attacker's payload is a genuine, correctly-structured Node2Shell exploitation attempt for node v24.22.0 – the Brotli stream, staged displacement, pivot pair, and delivery are all correct and identical to the public tooling," ELLIO said.
organisation RCE
"This is indicative of the RCE being adopted by an operator focused on mass exploitation.
‎Oct 28, 2026
Threat actors used the PolyShell vulnerability to breach hundreds of e-commerce stores by injecting a malicious loader via a Magento CMS block.
organisation Vulnerability / Web Security
 Ravie Lakshmanan  Oct 28, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
organisation Adobe Commerce
 Ravie Lakshmanan  Oct 28, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
organisation Magento
 Ravie Lakshmanan  Oct 28, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
organisation Google
 Ravie Lakshmanan  Oct 28, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
organisation Brotli
 Ravie Lakshmanan  Oct 28, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
organisation Known Exploited
 Ravie Lakshmanan  Oct 28, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
tactic T1588.006 - Vulnerabilities
 Ravie Lakshmanan  Oct 28, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
organisation KEV
 Ravie Lakshmanan  Oct 28, 2026 Vulnerability / Web Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation.
organisation Sansec
The development comes days after Sansec said it observed attackers leveraging CVE-2026-48356, also known as PolyShell, to breach hundreds of e-commerce stores to inject a malicious loader via a Magento CMS block.
organisation PolyShell
The development comes days after Sansec said it observed attackers leveraging CVE-2026-48356, also known as PolyShell, to breach hundreds of e-commerce stores to inject a malicious loader via a Magento CMS block.
organisation CMS
The development comes days after Sansec said it observed attackers leveraging CVE-2026-48356, also known as PolyShell, to breach hundreds of e-commerce stores to inject a malicious loader via a Magento CMS block.
‎2026/10/28
Threat actors exploited a Brotli vulnerability in Adobe Commerce PolyShell, resulting in the breach of hundreds of stores.
organisation Adobe Commerce PolyShell
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges.
organisation Brotli Exploit Traffic Emerges
Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges.
‎November 10, 2026
Federal Civilian Executive Branch agencies have until November 10, 2026, to apply fixes for two identified vulnerabilities in Adobe Commerce PolyShell.
organisation Federal Civilian Executive Branch
" Federal Civilian Executive Branch (FCEB) agencies have time until November 10, 2026, to apply the necessary fixes against the two flaws.
organisation FCEB
" Federal Civilian Executive Branch (FCEB) agencies have time until November 10, 2026, to apply the necessary fixes against the two flaws.
Tactical Metrics
Metrics
infrastructure
‎8.5.12-1
Software Version
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
Metrics
infrastructure
‎8.4.27-1
Software Version
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
Metrics
infrastructure
‎8.3.36-1
Software Version
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
Metrics
infrastructure
‎8.2.35-1
Software Version
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
Metrics
financial
1
Php
This includes PHP , which has shipped versions 8.5.12-1, 8.4.27-1, 8.3.36-1, and 8.2.35-1, as well as Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension, and the Ruby "brotli" gem.
Metrics
infrastructure
‎22.23.4
Software Version
Links to some of the advisories are below - "Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1," Akamai said .
Metrics
infrastructure
‎24.22.1
Software Version
Links to some of the advisories are below - "Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1," Akamai said .
Metrics
infrastructure
‎26.12.1
Software Version
Links to some of the advisories are below - "Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1," Akamai said .
Intelligence Sources
The Hacker News 2026-10-28