Changed since version 2

• Added the ELLIO report of the first in-the-wild Node2Shell exploitation on 2026-10-26 (a 23 MB Brotli request with an original ROP chain targeting Node.js v24.22.0 x86-64) to the title, timeline, verify, triage and contain. Source: change feed (ELLIO); URL not in source set.
• Added ELLIO's reproduction across node:http, slim image, Express 5.3.0 and Koa 3, with per-build offsets. Scope now names Express 5 default JSON parsing, and enumerate now includes build and architecture. Source: change feed (ELLIO).
• Added the PHP Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1 and 8.2.35-1 with Brotli 1.2.1, and cURL auto-decompression reachability, to fixed_in, only_if and the timeline. Source: change feed (PHP).
• Widened affected and enumerate to Bun, .NET, Python Brotli/brotlicffi, Envoy, Istio and cdxgen. Flagged reported Node.js workarounds as an open question because they contradict the published card. Source: change feed.
• Kept the Keitaro TDS detail in open_questions because the change feed (page_changed 2026-10-27) does not identify its source page.
• Added an open question on the conflicting KEV dates for CVE-2026-111497 in the change feed (2026-10-27 vs 2026-10-28).
• Rewrote confidence_reason, which was truncated in v2.

What happened

• CISA added CVE-2026-48356 (Adobe Commerce/Magento unrestricted file upload, PolyShell) and CVE-2026-111497 (Google Brotli decoder, Node2Shell) to KEV on 2026-10-27, based on evidence of active exploitation. The federal due date is 2026-11-10 [S1].
• Sansec reports that PolyShell was used to breach hundreds of stores and inject a loader through a Magento CMS block. The loader fetches and runs an attacker payload. No next-stage malware has been recovered [S2][S3].
• The wider campaign covers 953 stores since July 2025 and uses five rotating loader domains with visitor fingerprinting. PolyShell is reported as initial access on 471 stores, and SessionReaper (CVE-2025-54236) uploads were also used [S3][S4].
• Reported artifacts include PNG-disguised webshells in pub/media/custom_options/quote/, rogue admin accounts and a GSocket backdoor. Some were found on fully patched stores [S3][S4][S5].
• Honeypots recorded Brotli exploit attempts, including public Node2Shell exploit traffic from 94.154.43[.]7. The public exploit is reported to give a shell on vulnerable builds [S2][S5].

Timeline

Detect

Node.js process spawning a shell · EDR process events / Sysmon for Linux

index=* (ParentImage="*/node" OR ParentImage="*/nodejs") (Image="*/sh" OR Image="*/bash" OR Image="*/dash") | stats count min(_time) as first max(_time) as last values(CommandLine) as cmd by host, ParentImage, Image

A hit means: A node process started a shell. This matches the reported Node2Shell outcome on vulnerable builds. Check it against build tooling, and treat hits on Node.js 24.22.0 x86-64 hosts first.

Traffic from the reported Node2Shell exploit source · Web server, load balancer, WAF or firewall logs

index=* "94.154.43.7" | stats count min(_time) as first max(_time) as last by host, sourcetype

A hit means: The reported exploit source reached your edge. Check whether the target service decodes Brotli and runs an unpatched build.

Traffic to Magento loader domains · Proxy, DNS, firewall or CSP violation reports

index=* ("manulfie.click" OR "neswnsssn.click" OR "lanhd6549tdhse.top" OR "additionalver.com" OR "deepveindrilling.com") | stats count min(_time) as first max(_time) as last by host, sourcetype

A hit means: A browser or server contacted a reported loader domain. If the hit is in a CSP report, a storefront page is likely serving the loader.

Requests to the PolyShell upload path · Web server access log / file integrity monitoring

index=* "pub/media/custom_options/quote/" | stats count values(status) as status min(_time) as first by host, clientip, uri

A hit means: Possible webshell upload or access in the directory where PNG-disguised webshells were reported.

Verify

• Node: check the node build version and architecture on the host. A shell under node on a build older than the fixed releases is a true-positive candidate [S5]. The reported in-the-wild exploit targeted v24.22.0 x86-64, and each build needs its own offset (per change feed, ELLIO).
• Node benign look-alike: npm scripts, build tools and child_process calls in your own code spawn shells under node. Compare the command line with the deployed application.
• Node: crashes after requests with Brotli-encoded bodies may indicate failed exploit attempts [S2]. A very large Brotli request (23 MB reported in the wild) just before a crash or shell strengthens the signal (per change feed).
• Magento: query cms_block and cms_page directly for script tags or loader domains, and compare against content change records [S2][S3].
• Magento: open the files in pub/media/custom_options/quote/. A .png that contains PHP code is a webshell [S4].
• Magento: check admin_user for unexplained accounts, and correlate their creation time with CMS edits [S3][S4].

Scope

Affected

• Adobe Commerce and Magento without APSB26-73 (PolyShell, CVE-2026-48356) [S1][S2]
• Magento / Adobe Commerce vulnerable to SessionReaper (CVE-2025-54236) [S3]
• Fully patched stores where a rogue admin or GSocket backdoor was already placed [S3][S5]
• Google Brotli decoder (CVE-2026-111497) and products that embed it, including Node.js [S1]
• Per change feed and exposure data (not in source set): Bun, .NET, Python Brotli/brotlicffi, Envoy, Istio, cdxgen, PHP Windows builds, ClickHouse, Ruby brotli gem

Only if

• Brotli: the application decompresses attacker-controlled Brotli data, for example via node:zlib or Express 5 default JSON body parsing
• PHP: Brotli reachable through cURL auto-decompression (per change feed; source not in set)

Not affected if

• Node.js service does not decode attacker-influenced Brotli

Fixed in: Adobe APSB26-73 (PolyShell). Node.js 22.23.4, 24.22.1, 26.12.1; Brotli v1.2.1; PHP Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1 (per published card, change feed and exposure data; confirm with vendors). The sources do not state the SessionReaper fix version.

Enumerate

• All Node.js runtimes with exact version and CPU architecture, including containers, serverless and vendor appliances; flag 24.22.0 x86-64
• Other Brotli-embedding software in use (Bun, .NET, Python brotli/brotlicffi, Envoy, Istio, PHP on Windows, proxies) and the Brotli version each bundles
• Services that accept Brotli-encoded request bodies from untrusted clients
• All Magento / Adobe Commerce instances with patch level, including agency-hosted, vendor-hosted and acquired storefronts
• Admin accounts and their creation dates on each Magento instance
• cms_block and cms_page entries that contain script references

Contain

• Preserve evidence first: snapshot affected hosts, the Magento database, the web root and the access logs.
• Patch internet-facing Node.js and other Brotli-embedding services to fixed builds, starting with Node.js 24.22.0 x86-64 [S1].
• Block 94.154.43.7 at the edge. This is reversible [S2].
• Block the five loader domains at proxy and DNS, and in CSP where you control it [S3].
• Disable unrecognised Magento admin accounts and rotate all admin credentials. Disabling is reversible. Deleting removes evidence, so wait until evidence is collected.
• Export injected CMS blocks before removing them. Once removed, they cannot be recovered from the live system.
• Apply APSB26-73 and restrict Magento admin access by network where possible [S1].

Eradicate

• On Node.js hosts with a shell hit, find and remove what the shell dropped. The sources do not describe post-exploitation activity.
• Remove PNG-disguised webshells from pub/media/custom_options/quote/ [S4].
• Remove rogue admin accounts [S4].
• Remove the GSocket backdoor and look for its persistence. The sources do not describe that persistence [S3][S5].
• Clean the loader out of cms_block and cms_page [S2][S3].

Recover

• Before restoring, confirm that every exposed service runs fixed Node.js, Brotli and PHP builds.
• Before restoring Magento, confirm that no CMS script references, unknown admins or upload-path files remain, and that APSB26-73 is applied.
• After restoring, monitor for shells under node, crashes after large Brotli requests, and traffic from new exploit sources.
• Monitor CSP reports and DNS for the loader domains and any new rotating domains.
• Watch for new admin accounts and new files in pub/media/custom_options/quote/.

Re-enter the loop when

• New Node2Shell exploit sources, new ROP chains for other Node.js builds or architectures, or new loader domains are published. The loader domains are reported to rotate.
• The next-stage Magento payload is recovered and described.
• Another Brotli-embedding product is reported exploited.
• Adobe, Node.js, Google, PHP or another embedding vendor changes its advisory, fixed versions or workarounds.
• GSocket, a webshell or a node-spawned shell is found on a host already marked clean.
• Third-party or vendor storefronts or services that touch your customers are found in scope.

Debrief

• Record which initial access vector applied to each Magento instance: PolyShell, SessionReaper or rogue admin.
• Record which services decoded untrusted Brotli, their build and architecture, and how long they ran unpatched after 2026-10-21.
• Record dwell time between the first CMS change or first exploit traffic and detection.
• Gap: the Magento next-stage payload has not been recovered, so data-theft impact is unknown [S2].
• Gap: the sources do not say how rogue admins were created on fully patched stores.
• Gap: GSocket persistence and Node2Shell post-exploitation activity are not described.

Detection coverage, to check

The model never claims coverage; the automated check fills this table from public sources once it has run.

Open questions

• The ELLIO in-the-wild exploitation report (2026-10-26, Node.js v24.22.0 x86-64) and ELLIO's reproduction report have no URL in the source set. Add them before publishing; the title and triage rely on them.
• The change feed says a source lists Node.js workarounds, but the text is truncated. The published card said no vendor workarounds exist. Confirm the workarounds and their source.
• The PHP rebuild note mentions Guzzle, but the text is truncated. Confirm whether Guzzle-based apps are reachable and which PHP source says so.
• Early campaign iterations reportedly used the Keitaro tracker as a traffic distribution system. The change feed does not say which page carries this; confirm before adding it.
• The behaviour quote 'carrying the public exploit that we confirmed gets a shell on vulnerable builds' is attributed to the CISA KEV page, which is unlikely. Confirm whether it comes from S2 or S5.
• The change feed dates the KEV addition of CVE-2026-111497 as both 2026-10-27 and 2026-10-28. Confirm the dateAdded on the CISA page.
• The KEV entry references a BOD whose number is truncated in the change feed. Confirm it on the CISA page.
• The fixed versions for .NET, Python, Envoy, Istio, Bun, cdxgen, ClickHouse, the Ruby brotli gem and PAN-OS come from exposure data or the change feed without a cited URL. Confirm them against each vendor advisory.

Sources

• [S1] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · Cybersecurity and Infrastructure Security Agency (CISA)
• [S2] https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html · The Hacker News
• [S3] https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html · The Hacker News
• [S4] https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/ · SecurityWeek
• [S5] https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md · GitHub

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.