The Cybersecurity and Infrastructure Security Agency (CISA) said Tuesday it has evidence that attackers are exploiting a flaw in Brotli, a widely used data-compression library, along with a file-upload bug in Adobe Commerce and Magento online-store software. It is the U.S. government's first confirmation that the Brotli flaw, nicknamed Node2Shell, is under attack. For companies, the hard part is finding it: Brotli is built into programming runtimes, web proxies and network appliances rather than installed as a product of its own.
What Happened
In an alert, CISA added CVE-2026-111497 in Google's Brotli and CVE-2026-48356 in Adobe Commerce and Magento to its Known Exploited Vulnerabilities catalog. Under Binding Operational Directive 26-04, federal civilian agencies must fix both by Nov. 10. CISA named no attackers or victims.
The Brotli flaw, also called HTTP2Shell or Broccoli2Shell, sits in the decoder that unpacks compressed data. According to CISA's catalog entry, a remote attacker who needs no login can send a specially crafted compressed stream that corrupts memory, leaks data, crashes a service or possibly runs the attacker's code. OpenAI researchers reported it, The Hacker News reported, and Node.js and Google shipped fixes Oct. 21. Microsoft, Bun, Envoy, Istio and maintainers of two Python packages have also patched.
The Adobe bug, known as PolyShell, lets attackers upload dangerous files that can run code on a store's server. Adobe addressed it in security bulletin APSB26-73. The Primary Wire reported Monday that Sansec, a security vendor, linked PolyShell to a campaign that planted hidden code on 953 online stores.
What Attackers Are Doing
Early evidence comes from vendors that run honeypots, decoy systems that record attack traffic. ELLIO said its sensors caught a malicious request aimed at Node.js from an address that had earlier carried PHP2Shell exploits and probed Palo Alto Networks and Fortinet VPN devices. ELLIO assessed that an operator focused on mass exploitation had adopted the flaw. It also found that attacker's final code-execution stage produced no shell in 50 tests, though ELLIO achieved code execution itself in four setups. Previdian, another vendor, logged one exploitation attempt against its sensors as of Tuesday, The Hacker News reported.
Why It Matters
Patching one product is not enough. Tenable lists .NET, Bun, Envoy, Istio, Python HTTP clients, FFmpeg, Apache Arrow and ClickHouse among affected software, Help Net Security reported, and most maintainers have released fixes.
Failed attempts can crash the targeted process, ELLIO warned, so the flaw also threatens availability. Microsoft shipped an emergency .NET update Sunday, as The Primary Wire reported, and BleepingComputer noted that after patching, teams must restart processes and rebuild container images. Where patching must wait, it suggests blocking Brotli-compressed requests at the proxy or firewall, or turning off Brotli decoding.
What to Watch
Watch for details of who is exploiting Node2Shell and against which products, for patches from appliance and proxy makers, and for the Nov. 10 federal deadline.
