StoryExploit / PoCcriticalExploited in the wild

CISA Adds Adobe PolyShell and Google Brotli Vulnerabilities to KEV Catalog

7 sources · 8 articlesFirst reported Oct 27, 2026 · 00:00 UTCUpdated Oct 28, 2026 · 14:26 UTC (5d ago)

What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Hackers infected 953 Magento stores using PolyShell CVE-2026-48356; CISA added it and Brotli CVE-2026-111497 to KEV with November 10 deadline.

Attackers exploited CVE-2026-48356 in Adobe Commerce and Magento, known as PolyShell, to inject scanner-evading JavaScript loaders into 953 mostly Magento online stores since July 2025. The loaders reside in cms_block entries and check visitor type before serving code, with the latest version on deepveindrilling.com seen on 83 stores. CISA added CVE-2026-48356 and Google's Brotli decoder CVE-2026-111497 to its Known Exploited Vulnerabilities catalog on October 27, 2026, requiring federal civilian agencies to apply mitigations by November 10, 2026. Adobe released fixes such as APSB26-73 and APSB25-88, but reinfections occurred on patched stores.

Key facts

CVE-2026-48356 (PolyShell) enables unrestricted file upload and code execution as current user
953 Magento stores infected since July 2025; latest loader on deepveindrilling.com (83 stores)
CISA added CVE-2026-48356 and CVE-2026-111497 to KEV October 27, 2026
Federal agencies must mitigate by November 10, 2026 under BOD 26-04
Brotli CVE-2026-111497 scores 9.2; exploit traffic from Netherlands IP observed
91% of cloud environments contain vulnerable Node.js resources

Analyze CVE-2026-111497 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first

Oct 6, 2026Latest loader domain registered · Infosecurity Magazine
Oct 23, 2026Patched store reinfected with rogue admin and GSocket · GBHackers, Infosecurity Magazine
Oct 27, 2026CISA adds both CVEs to KEV; Canadian Centre issues update · CISA KEV, Canadian Centre for Cyber Security, The Hacker News
Oct 28, 2026Reports detail Brotli exploit traffic and cloud vulnerabilities · The Hacker News, Security Affairs

What each outlet adds

beyond the shared facts

CISA KEVOfficial catalog entry, federal remediation deadline and forensics triage requirements
Sansec via Cyber Security News, GBHackers, Infosecurity953 stores infected since July 2025, loader evasion tactics and specific domains
The Hacker News, Security AffairsBrotli CVE-2026-111497 details, exploit traffic observations and Node.js/PHP update links
Canadian Centre for Cyber SecurityUpdated Adobe advisory links for Commerce, ColdFusion and other products

CVEs: CVE-2026-111497 CVE-2026-48356 CVE-2025-54236

Vendors: Google Adobe Microsoft
Products: Brotli Adobe Commerce Magento Node.js PHP Bun .NET After Effects Animate Audition Bridge Experience Manager
Malware: PolyShell GSocket
Organizations: CISA Wiz Sansec Previdian ELLIO Canadian Centre for Cyber Security
Countries: United States

Coverage

oldest first · one row per article · UTC

Oct 27, 00:00 UTC · 7d ago CISA Known Exploited VulnerabilitiesFirst report
CISA adds exploited Adobe Commerce and Magento upload flaw to KEV
CVE-2026-48356 can run code as the current user; federal agencies must mitigate by November 10.
Oct 27, 07:55 UTC · 6d ago Cyber Security News
Magecart-style script hits 953 Magento stores, Sansec says
The loader hides from scanners, and earlier waves used PolyShell and SessionReaper to plant webshells.
Oct 27, 09:49 UTC · 6d ago GBHackers
Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
Oct 27, 16:00 UTC · 6d ago Infosecurity Magazine
Attackers infect 953 Magento stores with scanner-evading JavaScript
Sansec says the campaign, active since July 2025, has used five loader domains and the final payload is still unknown.
Oct 27, 20:41 UTC · 6d ago Canadian Centre for Cyber Security
CISA adds Adobe CVE-2026-48356 to KEV after July advisories
Canada’s Cyber Centre points admins to July Adobe fixes covering After Effects, ColdFusion, AEM and other products.
Oct 28, 05:42 UTC · 5d ago The Hacker News
CISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
Oct 28, 10:05 UTC · 5d ago Security Affairs
CISA adds exploited Brotli and Adobe Commerce flaws to KEV
Federal agencies must fix CVE-2026-111497 and CVE-2026-48356 by October 29, 2026, after reported exploit traffic and store infections.
Oct 28, 14:26 UTC · 5d ago Canadian Centre for Cyber Security
Adobe patches flaws in Painter, Creative Cloud, Campaign, Connect
Canadian Cyber Centre advisory AV26-1092 points users to four Adobe bulletins for updates released as of October 27.

Vulnerabilities in this story

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2025-54236	Unauthenticated Session Takeover in Adobe Commerce and Magento (SessionReaper)	9.1	95%	KEVPoC ×2	Sep 9, 2025 KEV Oct 24, 2025
CVE-2026-111497	Buffer overflow in Google Brotli decoder 1.0.3–1.2.0	9.2	83%	KEVPoC ×25	11d ago KEV Oct 27, 2026
CVE-2026-48356	Unrestricted dangerous file upload in Adobe Commerce and Magento	9.3	45%	KEV	Jul 14, 2026 KEV Oct 27, 2026