CISA added two known-exploited vulnerabilities—Google Brotli decoder and CVE-2026-48356 affecting Adobe Commerce and Magento—to its Known Exploited Vulnerabilities catalog, citing active exploitation observed in the wild.

Administrators are urged to apply July 2026 patches or newer as these vulnerabilities are now in the KEV catalog.

A critical advisory warns of multiple active vulnerabilities in Brotli libraries, Adobe Commerce, and Magento, with attackers actively exploiting them.

Analysts warn that widespread use of Brotli decoding in Node.js services could leave large portions of cloud environments vulnerable, with risk depending on how Brotli data is decoded.

The Brotli flaw, now known as Broccoli2Shell, affects decoding libraries from versions 1.0.3 to 1.2.0 and allows unauthenticated code injection via manipulated data streams; fixed versions include 1.0.10, 1.1.1, and 1.2.1.

Threat intelligence notes indicate successful exploitation could lead to memory corruption, remote code execution, or shell access depending on how applications handle Brotli data.

The campaign against Brotli and Node.js decoders appears ongoing since July 2025, with telemetry showing exploitation attempts and tooling targeting Node.js v24.22.0 (Node2Shell/Broccoli2Shell).

Sansec reports that since July 2025, attackers compromised at least 953 Magento-based shops, with a March campaign utilizing the PolyShell Webshell and malicious URLs or compromised sites as infection vectors.

Administrators should treat systems using vulnerable Brotli libraries as compromised and apply updates immediately, as exploit attempts spread rapidly.

Rapid7’s Q3 threat landscape notes that critical vulnerabilities are typically exploited within about three days, with 71% of exploits occurring in the first week after disclosure.

Vendors and platforms have issued patches and advisories across Node.js, PHP, Bun, Envoy, Istio, .NET, Python, and related ecosystems to address these issues.

Security researchers emphasize wide exposure due to Brotli’s broad use, with updates released across multiple ecosystems, including Node.js, PHP, Bun, and Microsoft .NET.