Changed since version 1

• CVE-2026-48356 (PolyShell) is now on CISA KEV as of 2026-10-27, federal due 2026-11-10. This resolves the prior open question about its KEV status [S1].
• CVE-2026-111497 (Brotli, Node2Shell) is now on CISA KEV as of 2026-10-27, federal due 2026-11-10. The card nodejs-oct-2026 said it was not in KEV and had no in-the-wild exploitation; that no longer holds [S1].
• Brotli exploit attempts reported on honeypots, including from 94.154.43[.]7. Added an IP hunt and a node-to-shell hunt, and dropped the CMS-content hunt to keep four [S2][S5].
• Scope adds the Brotli decoder and embedding products, the Brotli exposure condition, and Node.js and Brotli fixed versions [S1].
• Added a new source: The Hacker News on PolyShell attacks. It reports no next-stage malware recovered [S2].
• Triage raised from P2 to P1, lane changed to Patch now + Hunt, and confidence raised from medium to high on CISA confirmation [S1].
• Sources renumbered: prior S1/S2/S3 are now S3/S4/S5; S1 is CISA KEV and S2 is the new Hacker News report.
• Keitaro TDS report placed in open_questions pending a source attribution.

What happened

• CISA added CVE-2026-48356 (Adobe Commerce/Magento unrestricted file upload, PolyShell) and CVE-2026-111497 (Google Brotli decoder, Node2Shell) to KEV on 2026-10-27, based on evidence of active exploitation. The federal due date is 2026-11-10 [S1].
• Sansec reports PolyShell used to breach hundreds of stores and inject a loader through a Magento CMS block. The loader fetches and runs an attacker payload; no next-stage malware has been recovered [S2][S3].
• The wider campaign covers 953 stores since July 2025, using five rotating loader domains with visitor fingerprinting. PolyShell is reported as initial access on 471 stores; SessionReaper (CVE-2025-54236) uploads were also used [S3][S4].
• Artifacts include PNG-disguised webshells in pub/media/custom_options/quote/, rogue admin accounts and a GSocket backdoor, including on fully patched stores [S3][S4][S5].
• Brotli exploit attempts were seen on honeypots, including public Node2Shell exploit traffic from 94.154.43[.]7. The public exploit is reported to give a shell on vulnerable builds [S2][S5].

Timeline

Detect

Node.js process spawning a shell · EDR process events / Sysmon for Linux

index=* (ParentImage="*/node" OR ParentImage="*/nodejs") (Image="*/sh" OR Image="*/bash" OR Image="*/dash") | stats count min(_time) as first max(_time) as last values(CommandLine) as cmd by host, ParentImage, Image

A hit means: A node process started a shell. This matches the reported Node2Shell outcome on vulnerable builds; confirm against build tooling.

Traffic from the reported Node2Shell exploit source · Web server, load balancer, WAF or firewall logs

index=* "94.154.43.7" | stats count min(_time) as first max(_time) as last by host, sourcetype

A hit means: The reported exploit source reached your edge. Check whether the target service decodes Brotli and runs an unpatched build.

Traffic to Magento loader domains · Proxy, DNS, firewall or CSP violation reports

index=* ("manulfie.click" OR "neswnsssn.click" OR "lanhd6549tdhse.top" OR "additionalver.com" OR "deepveindrilling.com") | stats count min(_time) as first max(_time) as last by host, sourcetype

A hit means: A browser or server contacted a reported loader domain. On a CSP report, a storefront page is likely serving the loader.

Requests to the PolyShell upload path · Web server access log / file integrity monitoring

index=* "pub/media/custom_options/quote/" | stats count values(status) as status min(_time) as first by host, clientip, uri

A hit means: Possible webshell upload or access in the directory where PNG-disguised webshells were reported.

Verify

• Node: check the node build version on the host. A shell under node on a build older than the fixed releases is a true-positive candidate [S5].
• Node benign look-alike: npm scripts, build tools and child_process calls in your own code spawn shells under node. Compare the command line with the deployed application.
• Node: crashes after requests with Brotli-encoded bodies may indicate exploit attempts that failed [S2].
• Magento: query cms_block and cms_page directly for script tags or loader domains. Compare against content change records [S2][S3].
• Magento: open files in pub/media/custom_options/quote/. A .png that contains PHP code is a webshell [S4].
• Magento: check admin_user for unexplained accounts and correlate their creation time with CMS edits [S3][S4].

Scope

Affected

• Adobe Commerce and Magento without APSB26-73 (PolyShell, CVE-2026-48356) [S1][S2]
• Magento / Adobe Commerce vulnerable to SessionReaper (CVE-2025-54236) [S3]
• Fully patched stores where a rogue admin or GSocket backdoor was already placed [S3][S5]
• Google Brotli decoder (CVE-2026-111497) and products that embed it, including Node.js [S1]

Only if

• Brotli: the application decompresses attacker-controlled Brotli data, for example via node:zlib or default request-body parsing

Not affected if

• Node.js service does not decode attacker-influenced Brotli

Fixed in: Adobe APSB26-73 (PolyShell). Node.js 22.23.4, 24.22.1, 26.12.1; Brotli v1.2.1 (per published card and exposure data; confirm with vendors). The SessionReaper fix version is not stated in the sources.

Enumerate

• All Node.js runtimes with version, including containers, serverless and vendor appliances
• Other Brotli-embedding software in use (proxies, service meshes, language runtimes) and their Brotli version
• Services that accept Brotli-encoded request bodies from untrusted clients
• All Magento / Adobe Commerce instances, including agency-hosted, vendor-hosted and acquired storefronts, with patch level
• Admin accounts and creation dates on each Magento instance
• cms_block and cms_page entries with script references

Contain

• Preserve evidence first: snapshot affected hosts, the Magento database, the web root and the access logs.
• Patch internet-facing Node.js and other Brotli-embedding services to fixed builds [S1].
• Block 94.154.43.7 at the edge. This is reversible [S2].
• Block the five loader domains at proxy and DNS, and in CSP where you control it [S3].
• Disable unrecognised Magento admin accounts and rotate all admin credentials. Disabling is reversible; deleting removes evidence, so wait until evidence is collected.
• Export injected CMS blocks before removing them. Once removed, they cannot be recovered from the live system.
• Apply APSB26-73 and restrict Magento admin access by network where possible [S1].

Eradicate

• On Node.js hosts with a shell hit, find and remove what the shell dropped; the sources do not describe post-exploitation activity.
• Remove PNG-disguised webshells from pub/media/custom_options/quote/ [S4].
• Remove rogue admin accounts [S4].
• Remove the GSocket backdoor and look for its persistence; the sources do not describe it [S3][S5].
• Clean the loader from cms_block and cms_page [S2][S3].

Recover

• Before restoring, validate Node.js and Brotli versions are fixed builds on every exposed service.
• Before restoring Magento, validate no CMS script references, unknown admins or upload-path files remain, and APSB26-73 is applied.
• After restoring, monitor for shells under node and for traffic from new exploit sources.
• Monitor CSP reports and DNS for the loader domains and any new rotating domains.
• Watch for new admin accounts and new files in pub/media/custom_options/quote/.

Re-enter the loop when

• New Node2Shell exploit sources or new loader domains are published; the loader domains are reported to rotate.
• The next-stage Magento payload is recovered and described.
• Another Brotli-embedding product is reported exploited.
• Adobe, Node.js or Google change their advisories or fixed versions.
• GSocket, a webshell or a node-spawned shell is found on a host already marked clean.
• Third-party or vendor storefronts or services touching your customers are found in scope.

Debrief

• Record which initial access vector applied to each Magento instance (PolyShell, SessionReaper or rogue admin).
• Record which services decoded untrusted Brotli and how long they ran unpatched after 2026-10-21.
• Record dwell time between first CMS change or first exploit traffic and detection.
• Gap: the Magento next-stage payload has not been recovered, so data-theft impact is unknown [S2].
• Gap: the sources do not say how rogue admins were created on fully patched stores.
• Gap: GSocket persistence and Node2Shell post-exploitation activity are not described.

Detection coverage, to check

The model never claims coverage; the automated check fills this table from public sources once it has run.

Open questions

• Reported: early campaign iterations used the Keitaro tracker as a traffic distribution system. The change feed does not say which source carries this; confirm before adding it to the card.
• The behaviour quote 'carrying the public exploit that we confirmed gets a shell on vulnerable builds' is attributed to the CISA KEV page, which is unlikely. Confirm whether it comes from S2 or the honeypot report S5.
• S5 is a single honeypot report. Its link to the rogue-admin and GSocket dates for a specific store is unclear.
• The KEV entry references a BOD whose number is truncated in the change feed; confirm it on the CISA page.
• The fixed versions for PHP, .NET, Python, Envoy, Istio, Bun, ClickHouse, the Ruby brotli gem and PAN-OS come from exposure data without a cited source. Confirm against each vendor advisory.
• The Sansec primary report is not in the sources. Verify the 953 and 471 figures and the full domain list against it.
• What fixed version addresses SessionReaper (CVE-2025-54236)?
• The evidence sample 'QWE=123;' in an HTTP response is not explained by the sources.

Sources

• [S1] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · Cybersecurity and Infrastructure Security Agency (CISA)
• [S2] https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html · The Hacker News
• [S3] https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html · The Hacker News
• [S4] https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/ · SecurityWeek
• [S5] https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md · GitHub

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.