US warns of two serious security flaws being exploited in attacks

CISA added two severe vulnerabilities to its KEV catalog: CVE-2026-48356 in Adobe Commerce/Magento and CVE-2026-111497 in Google Brotli. Review the details, PolyShell infection vectors, cloud exposure statistics from Wiz, and multi-vendor patch advisories including Node.js.

The problem in the Brotli library

The first issue concerns the Brotli data compression tool, which is widely used in a number of applications and services worldwide.

This vulnerability, known as Node2Shell, HTTP2Shell or Broccoli2Shell, could allow an attacker to corrupt a system's memory, cause a system crash, or even execute code remotely if the application processes data sent by a malicious user.

Security firms have detected web traffic attempting to exploit this issue, with attempts recorded coming from IP addresses in the United States and the Netherlands, among others.

Meanwhile, estimates from Wiz indicate that the vast majority of cloud computing environments have affected resources, with a significant percentage maintaining publicly exposed Node.js installations.

Due to the widespread use of Brotli, dozens of developers and software providers have rushed to release security updates, including:

• PHP
• Node.js
• Bun
• Envoy Proxy
• Istio
• .NET
• Python
• and others

For example, Node.js fixed the issue in versions 22.23.4, 24.22.1, and 26.12.1.

Attacks on online stores

The second issue is found in the Adobe Commerce and Magento platforms. This vulnerability concerns the ability to upload files without the necessary restrictions, allowing unknown parties to execute code and potentially gain control over user accounts or sessions.

Security researchers reported that this activity, known as PolyShell, has been used to compromise hundreds of online stores since July 2025. The perpetrators insert malicious code through specific content points on the platforms, aiming to infect the stores with additional programs.