Adobe Commerce PolyShell & Brotli Exploits Cripple Hundreds of E-Commerce Sites

Overview/Introduction

In the last week, the cybersecurity community has observed a coordinated wave of attacks targeting Adobe Commerce (formerly Magento) installations worldwide. The campaign leverages two high-severity vulnerabilities that were simultaneously added to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-48356 - an unrestricted file-upload flaw in Adobe Commerce that enables arbitrary code execution (often referred to as “PolyShell”).
• CVE-2026-111497 - a memory-corruption bug in Google’s Brotli decoder library that can be triggered via Node.js’s zlib APIs (also known as “Brotli2Shell”, “Node2Shell”, or “HTTP2Shell”).

Both vulnerabilities are being weaponised in the wild, with threat-intel feeds confirming active exploitation against live e-commerce sites and evidence of exploit traffic targeting vulnerable Node.js applications. The combined effect is a mass-scale compromise of hundreds of online stores, data exfiltration, and the deployment of persistent back-doors.

Technical Details

CVE-2026-48356 (PolyShell)

Adobe Commerce’s admin UI allows merchants to upload media assets (images, PDFs, etc.) for use in product pages and CMS blocks. The vulnerability stems from an unchecked MIME-type validation and a missing file-extension whitelist. An attacker can craft a multipart request that uploads a PHP web-shell disguised as a harmless image. Once the file resides in the web-root, it can be invoked via a specially crafted CMS block, giving the attacker full PHP execution under the web-server user.

Key attributes:

• Impact: Remote, unauthenticated code execution.
• CVSS: 9.3 (Critical).
• Exploit Chain: Upload → CMS block injection → Web-shell execution → Loader fetch.

CVE-2026-111497 (Brotli2Shell / Node2Shell)

The Brotli decoder library, widely used for HTTP/2 and HTTP/3 compression, contains an unchecked return-value bug. When a maliciously crafted Brotli stream is decompressed via the Node.js zlib.brotliDecompress or zlib.createBrotliDecompress APIs, the decoder corrupts adjacent memory structures. On vulnerable Node.js versions (v18.15.0-v20.6.0), this can be escalated to arbitrary code execution, a denial-of-service, or memory disclosure.

Attackers have been observed delivering the payload through two primary vectors:

1. HTTP request bodies: Web applications that accept compressed request bodies (e.g., GraphQL, file-upload endpoints) forward the payload directly to zlib without validation.
2. Downstream services: Proxy or API-gateway layers that decompress inbound traffic before routing it to backend services.

Telemetry from Previdian and ELLIO shows exploit attempts originating from IP 94.154.43.7 (Netherlands) and a U.S. address, confirming at least one successful shell on a vulnerable Node.js host.

Impact Analysis

The combined exploitation of PolyShell and Brotli2Shell creates a “double-punch” scenario:

• Adobe Commerce sites: More than 300 stores have been confirmed compromised since July 2025. The malicious loader inserted via a CMS block fetches additional payloads, potentially ransomware, cryptocurrency miners, or data-stealing modules.
• Node.js applications: Any service that decompresses attacker-controlled Brotli data-Express 5, Fastify, the native fetch API, or custom micro-services-faces remote code execution risk. This expands the attack surface beyond e-commerce to API back-ends, CI/CD pipelines, and even internal tooling.
• Downstream services: Companies that ingest compressed logs, telemetry, or analytics data from untrusted sources may inadvertently trigger the vulnerability, leading to supply-chain compromise.

Data exposed includes customer PII (names, emails, addresses), payment tokens, and order histories. While no ransomware ransom notes have been publicly recovered, the presence of a persistent loader suggests the attackers are positioning for a secondary payload drop.

Timeline of Events

• June 2025: Initial public disclosure of CVE-2026-48356 by Adobe Security Bulletin.
• July 2025: First evidence of PolyShell exploitation observed by Sansec.
• March 2026: Google releases Brotli 1.0.9 fixing a memory-corruption bug (later assigned CVE-2026-111497).
• July 2026: Node.js incorporates the upstream Brotli fix into v20.7.0 and v18.16.0.
• October 24 2026: CISA adds CVE-2026-48356 and CVE-2026-111497 to KEV catalog, cites active exploitation.
• October 27 2026: First Brotli exploit attempt recorded on a U.S. honeypot (Previdian).
• October 28 2026: The Hacker News publishes the combined breach report; Adobe issues emergency patches.
• November 10 2026: CISA deadline for federal agencies to remediate both CVEs.

Mitigation/Recommendations

1. Patch immediately:
   • Adobe Commerce: Upgrade to version 2.4.12-p2 or later, which includes a hardened file-type whitelist and CSRF token validation on upload endpoints.
   • Node.js: Upgrade to v20.7.2 or v18.16.2, which incorporates the Brotli fix. For older LTS branches, back-port the patch from the official repo.
   • Google Brotli: Deploy version 1.0.10 or newer for any native library usage.
2. Restrict upload vectors: Enforce strict MIME-type and file-extension checks, store uploads outside the web-root, and serve them via a CDN with signed URLs.
3. Validate compressed payloads: Reject Brotli-compressed request bodies from unauthenticated sources. If decompression is required, use a sandboxed process (e.g., spawn with limited privileges) and set a size/entropy limit.
4. Network-level controls: Block inbound traffic from known malicious IPs (e.g., 94.154.43.7) at the firewall or WAF level. Enable request-body inspection for compressed content.
5. Monitoring & detection:
   • Deploy IDS/IPS signatures for the “Brotli2Shell” shellcode pattern (available from Rapid7 and ELLIO).
   • Audit CMS block content for unexpected <script> or iframe tags that load external resources.
   • Enable file-integrity monitoring on the web-root to detect newly added PHP shells.
6. Incident response preparedness: Assume breach for any store that has not patched since July 2025. Conduct forensic imaging, rotate credentials, and invalidate any stored payment tokens.

Real-World Impact

For merchants, the breach translates to immediate loss of consumer trust, potential PCI-DSS non-compliance penalties, and the cost of forensic investigations. A single compromised store can serve as a foothold for lateral movement into partner APIs, supply-chain services, or even internal corporate portals that share the same Node.js runtime.

From a broader industry perspective, the attack highlights a dangerous convergence of two independent flaw classes-application-level file upload and low-level compression libraries. Attackers are chaining them to bypass traditional perimeter defenses, turning a seemingly innocuous “image upload” into a remote code execution vector that works across language runtimes (PHP, Node.js, Python when using Brotli bindings).

Expert Opinion

As a senior analyst, I see this campaign as a watershed moment for web-application security. First, the rapid adoption of Brotli for HTTP/2/3 performance optimisation has created a blind spot: many dev teams trust the library implicitly and never consider that a malicious client could supply a crafted stream. Second, the PolyShell technique is a classic “upload-then-execute” scenario, but the fact that it is being paired with a low-level memory corruption exploit shows attackers are moving beyond single-point exploits toward multi-stage, cross-stack kill chains.

Enterprises must treat compression libraries as part of their attack surface, enforce strict content-type policies, and adopt defense-in-depth measures such as runtime application self-protection (RASP) and container-level isolation. The CISA KEV deadline underscores the urgency-government entities will be forced to patch, and the private sector should follow suit before the next wave of automated scanners begins probing every exposed Node.js endpoint.

Finally, the timeline suggests that the vulnerability was known for months before a coordinated patch release, giving threat actors ample time to weaponise it. This reinforces the need for a proactive vulnerability-management program that monitors upstream library advisories (e.g., Google Brotli) and integrates automated testing for malformed compressed data.