Urgent awareness alert. This is awareness content, not a monitored threat intelligence service: always check vendor advisories against your own environment.
On 27 October 2026 CISA added two flaws to its Known Exploited Vulnerabilities catalogue, based on evidence of active exploitation.
Adobe Commerce and Magento Open Source (CVE-2026-48356, CVSS 9.3), known as PolyShell, is an unrestricted file upload flaw that can lead to code execution. Adobe fixed it on 14 July 2026 in security bulletin APSB26-73, but stores that have not applied that update are now being breached, with webshells planted on compromised stores.
Brotli in Node.js (CVE-2026-111497, CVSS 9.2), known as Node2Shell, is an out-of-bounds write in the Brotli decoder bundled with Node.js. An attacker who can supply compressed data that an application decompresses can crash the process, read process memory, or run code. Node.js 22.x, 24.x, and 26.x are affected, and other software that bundles Brotli, including some Python packages, is also affected.
What to do:
- Apply Adobe security bulletin APSB26-73 to every Adobe Commerce and Magento Open Source installation.
- Update Node.js to 22.23.4, 24.22.1, 26.12.1, or later, and update other software and packages that bundle Brotli as their vendors release fixes. End-of-life Node.js versions will not be fixed, so move them to a supported release.
- Check for compromise: look for unexpected files in upload folders (including image files that contain code), unfamiliar scripts in pages and content blocks, and unexpected crashes or outbound connections from Node.js services.
Source: CISA alert, 27 October 2026, Adobe APSB26-73, and Node.js October 2026 security releases
If you would like help assessing your exposure, contact us.
