Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In October 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-48356 (CVSS 9.3), an unrestricted file upload flaw in Adobe Commerce and Magento dubbed PolyShell, and CVE-2026-111497 (CVSS 9.2), a memory-corruption RCE in Google's Brotli decoder library dubbed Node2Shell. Threat actors exploited CVE-2026-48356 to breach over 953 e-commerce stores, injecting malicious loaders via Magento CMS blocks active since at least July 2025. Simultaneously, live Node2Shell exploit traffic was recorded in the wild from a Netherlands-based IP also linked to PHP2Shell campaigns, signaling mass-exploitation tooling adoption across the web stack.

These twin campaigns illustrate a maturing pattern of attackers chaining supply-chain library flaws with CMS upload vulnerabilities to achieve persistent RCE at scale. With 91% of cloud environments reported vulnerable to CVE-2026-111497 and FCEB agencies given until November 10, 2026 to patch, organizations running unpatched Node.js, PHP, or Adobe Commerce instances face immediate, high-probability compromise risk.

Why This Matters Now

CISA's emergency KEV listing and active in-the-wild exploitation of both CVE-2026-48356 and CVE-2026-111497 mean patch windows are effectively closed. With 82% of cloud environments exposing vulnerable Node.js instances publicly and a confirmed mass-exploitation operator already deploying Node2Shell tooling, every unpatched internet-facing application is a live target today.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

CVE-2026-48356 is a critical unrestricted file upload vulnerability in Adobe Commerce and Magento (CVSS 9.3) that allows unauthenticated attackers to upload malicious files and execute arbitrary code. Attackers exploited it to inject loader scripts into Magento CMS blocks across more than 953 stores, enabling persistent remote code execution since at least July 2025.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because both CVE-2026-48356 and CVE-2026-111497 exploits relied on publicly reachable application surfaces, unrestricted outbound paths, and uncontrolled east-west access to propagate across cloud environments. By enforcing inline inspection, workload-scoped segmentation, and controlled egress, the blast radius across hundreds of affected e-commerce stores and exposed Node.js instances would likely have been significantly reduced.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Inline inspection of inbound exploit traffic targeting known CVE signatures could have flagged and constrained these malicious payloads before they reached vulnerable application endpoints, reducing the number of stores and Node.js instances successfully compromised in the initial wave.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Identity-aware, least-privilege segmentation policies would likely have constrained the execution context of compromised workloads, limiting how far escalated privileges could extend beyond the initially affected application boundary and reducing the scope of attacker-controlled access within the environment.

Lateral Movement

Control: East-West Traffic Security

Mitigation: Microsegmentation policies enforcing workload identity verification on east-west traffic would likely have constrained unauthorized service-to-service connections originating from compromised application tiers, reducing the attacker's ability to reach payment backends, credential stores, or cloud management APIs from an initially breached workload.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Traffic observability across cloud environments would likely have surfaced anomalous outbound fetch patterns from compromised application workloads toward unknown external destinations, enabling detection and response workflows that could constrain the active C2 channel and reduce the attacker's ability to deliver follow-on payloads at scale.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: FQDN-based egress filtering policies would likely have constrained unauthorized outbound data flows from compromised application workloads toward attacker-controlled infrastructure, reducing the volume and reach of potential skimmer-driven exfiltration by limiting which external destinations application tiers were permitted to communicate with.

Impact (Mitigations)

Had earlier CNSF controls constrained initial exploit delivery, lateral movement, and egress paths, the sustained impact across hundreds of stores would likely have been reduced in scope, with attacker persistence limited to fewer workloads and the reach of active loader-driven payload execution contained to smaller isolated segments rather than propagating broadly across cloud-exposed merchant infrastructure.

Impact at a Glance

Affected Business Functions

  • E-commerce Storefront Operations and Checkout Processing
  • Customer Payment Card and PII Data Handling
  • CMS and Catalog Content Integrity
  • Backend Node.js and PHP Application Services
Operational Disruption

Estimated downtime: 14 days

Financial Impact

Estimated loss: N/A

Data Exposure

Confirmed injection of malicious loaders into Magento CMS blocks across approximately 953 e-commerce stores, enabling attacker-controlled payload execution. Customer PII including names, email addresses, shipping addresses, and payment card data stored within Adobe Commerce and Magento environments is at risk of exfiltration. Session tokens and account credentials may be harvested via injected scripts. The Brotli decoder flaw (CVE-2026-111497) additionally exposes sensitive process memory in any internet-facing Node.js, PHP, Bun, Envoy, Istio, or .NET service that processes attacker-supplied Brotli-compressed data, with 91% of cloud environments reported as containing vulnerable resources and 82% having publicly exposed Node.js instances according to Wiz telemetry. Financial loss is not formally quantified in reporting but is assessed as potentially very high given the scale of affected stores and ongoing campaign activity since at least July 2025.

Recommended Actions

  • • Deploy CNSF Inline IPS (Suricata) with up-to-date signatures for CVE-2026-48356 (PolyShell) and CVE-2026-111497 (Node2Shell) exploit traffic patterns to detect and block known malicious payloads and Brotli decoder exploit attempts at the network layer before they reach vulnerable application endpoints.
  • • Enforce Zero Trust Segmentation with least-privilege, identity-based microsegmentation policies to isolate Adobe Commerce and Node.js application workloads from internal databases, payment backends, and cloud management APIs, preventing lateral movement following an initial web application compromise.
  • • Activate Egress Security and Policy Enforcement with FQDN-based outbound filtering to block unauthorized payload retrieval and C2 callbacks from compromised e-commerce servers, disrupting the PolyShell loader's ability to fetch and execute attacker-controlled next-stage malware.
  • • Leverage Multicloud Visibility and Control with centralized traffic observability and anomaly detection to baseline normal outbound behavior for Node.js and Magento workloads, enabling rapid identification of anomalous external connections, repeated malformed Brotli-compressed requests, and suspicious automation indicative of mass exploitation activity.
  • • Prioritize immediate patching of Node.js to versions 22.23.4, 24.22.1, or 26.12.1 and apply Adobe Commerce patches for CVE-2026-48356 by the CISA FCEB deadline of November 10, 2026, supplementing patch cycles with Cloud Firewall (ACF) internet egress controls and Cloud Native Security Fabric distributed policy enforcement to reduce exposure of publicly accessible Node.js instances identified as 82% exposed across cloud environments.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image