Overview
- CISA placed CVE-2026-111497 (the Brotli decoder bug) and CVE-2026-48356 (PolyShell in Adobe Commerce/Magento) on its Known Exploited Vulnerabilities catalog after evidence showed active attacks.
- The Brotli flaw is an unchecked return/out-of-bounds error in Google’s Brotli C decoder that can corrupt decoder memory, crash processes, disclose memory contents, or enable remote code execution when software decompresses attacker-controlled Brotli data.
- Sansec reported that attackers have used the PolyShell upload flaw to breach hundreds of online stores since at least July 2025 by injecting a CMS loader that is designed to fetch and run an attacker-controlled payload.
- Threat-intel firms recorded live exploit attempts and honeypot hits for the Brotli issue, with ELLIO and Previdian observing exploit traffic and an IP linked to the Netherlands and Imperva demonstrating RCE in a vulnerable Node.js image.
- Vendors including Node.js, PHP, Bun, Envoy, Istio, .NET and Python have issued patches and advisories and operators must update binaries, rebuild container images, and restart services because no single runtime workaround exists and federal agencies must remediate by November 10, 2026.