Changed since version 3

• Lane changed from Patch to Patch now + Hunt and priority set to P1: CISA added CVE-2026-111497 to KEV with a 2026-11-10 due date. The published card said it was not in KEV [S1].
• Exploitation status changed from no in-the-wild exploitation to actively exploited per CISA [S1]. ELLIO's 2026-10-26 in-the-wild report against Node.js v24.22.0 x86-64 is added as per change feed, URL pending.
• Added honeypot exploit traffic from 94.154.43.7 and a matching hunt and block [S2][S5].
• Added ELLIO reproduction on x86-64 across node:http, slim image, Express 5.3.0 and Koa 3, with per-build offsets, to scope conditions (per change feed).
• Added Magento PolyShell (CVE-2026-48356) KEV listing and the 953-store loader campaign, with hunts, verification, containment and eradication steps [S1][S2][S3][S4].
• Widened affected scope to other Brotli embedders (Bun, .NET, Python, Envoy, Istio, cdxgen, ClickHouse, Ruby gem) and PHP Windows rebuilds with Brotli 1.2.1 (per change feed and exposure data; sources not in set).
• The published card's 'no vendor workarounds' statement is now uncertain: the change feed reports Node.js workarounds. Moved to open questions pending confirmation.
• Removed the published card's detection-coverage statement (scanner QID and vendor status); replaced with per-category coverage checks.
• Versus prior draft v3: title and triage now rest on the CISA KEV listing [S1], not the unsourced ELLIO report; fixed-version and patch steps no longer cite S1; dropped unverified 2026-09 store events from the timeline; added KEV date discrepancy, PAN-OS and behaviors-attribution items to open questions.

What happened

• CISA added CVE-2026-111497 (Google Brotli decoder, Node2Shell) and CVE-2026-48356 (Adobe Commerce/Magento unrestricted file upload, PolyShell) to KEV based on evidence of active exploitation. The federal due date is 2026-11-10 [S1].
• Honeypots recorded Brotli exploit attempts, including public Node2Shell exploit traffic from 94.154.43[.]7. The public exploit is reported to give a shell on vulnerable builds [S2][S5].
• Sansec reports that PolyShell was used to breach hundreds of stores and inject a loader through a Magento CMS block. The loader fetches and runs an attacker payload. No next-stage malware has been recovered [S2].
• The wider campaign covers 953 stores since July 2025 and uses five rotating loader domains with visitor fingerprinting. PolyShell is reported as initial access on 471 stores, and SessionReaper (CVE-2025-54236) uploads were also used [S3][S4].
• Reported artifacts include PNG-disguised webshells in pub/media/custom_options/quote/, rogue admin accounts and a GSocket backdoor. Some were found on fully patched stores [S3][S4].

Timeline

Detect

Node.js process spawning a shell · EDR process events / Sysmon for Linux

index=* (ParentImage="*/node" OR ParentImage="*/nodejs") (Image="*/sh" OR Image="*/bash" OR Image="*/dash") | stats count min(_time) as first max(_time) as last values(CommandLine) as cmd by host, ParentImage, Image

FROM logs-* | WHERE (process.parent.executable LIKE "*/node" OR process.parent.executable LIKE "*/nodejs") AND (process.executable LIKE "*/sh" OR process.executable LIKE "*/bash" OR process.executable LIKE "*/dash") | STATS count = COUNT(*), first = MIN(@timestamp), last = MAX(@timestamp), cmd = VALUES(process.command_line) BY host.name, process.parent.executable, process.executable

A hit means: A node process started a shell, the outcome the public exploit is reported to produce [S5]. Rule out build tooling first; treat hits on unpatched Node.js builds, especially 24.22.0 x86-64, first.

Traffic from the reported Node2Shell exploit source · Web server, load balancer, WAF or firewall logs

index=* "94.154.43.7" | stats count min(_time) as first max(_time) as last by host, sourcetype

A hit means: The reported exploit source reached your edge [S2][S5]. Check whether the target service decodes Brotli request bodies and runs an unpatched build.

Traffic to Magento loader domains · Proxy, DNS, firewall or CSP violation reports

index=* ("manulfie.click" OR "neswnsssn.click" OR "lanhd6549tdhse.top" OR "additionalver.com" OR "deepveindrilling.com") | stats count min(_time) as first max(_time) as last by host, sourcetype

A hit means: A browser or server contacted a reported loader domain [S3]. A hit in CSP reports suggests a storefront page is serving the loader.

Requests to the PolyShell upload path · Web server access log / file integrity monitoring

index=* "pub/media/custom_options/quote/" | stats count values(status) as status min(_time) as first by host, clientip, uri

FROM logs-* | WHERE url.path LIKE "*pub/media/custom_options/quote/*" OR url.original LIKE "*pub/media/custom_options/quote/*" OR file.path LIKE "*pub/media/custom_options/quote/*" | STATS count = COUNT(*), status = VALUES(http.response.status_code), first = MIN(@timestamp) BY host.name, source.ip, url.path

A hit means: Possible webshell upload or access in the directory where PNG-disguised webshells were reported [S4].

Verify

• Node: check the build version and architecture on the host. A shell under node on a build older than the fixed releases is a true-positive candidate [S5]. The reported in-the-wild exploit targeted v24.22.0 x86-64, and each build needs its own offset (per change feed, ELLIO).
• Node benign look-alike: npm scripts, build tools and child_process calls in your own code spawn shells under node. Compare the command line with the deployed application.
• Node: crashes after requests with Brotli-encoded bodies may indicate failed exploit attempts [S2]. A very large Brotli request (23 MB reported in the wild) just before a crash or shell strengthens the signal (per change feed).
• Magento: query cms_block and cms_page directly for script tags or loader domains, and compare against content change records [S2][S3].
• Magento: open files in pub/media/custom_options/quote/. A .png containing PHP code is a webshell [S4].
• Magento: check admin_user for unexplained accounts and correlate their creation time with CMS edits [S3][S4].

Scope

Affected

• Google Brotli decoder (CVE-2026-111497) and products that embed it, including Node.js [S1]
• Adobe Commerce and Magento without APSB26-73 (PolyShell, CVE-2026-48356) [S1][S2]
• Magento / Adobe Commerce vulnerable to SessionReaper (CVE-2025-54236) [S3]
• Fully patched stores where a rogue admin or GSocket backdoor was already placed [S3][S4]
• Per change feed and exposure data (not in source set): Bun, .NET, Python Brotli/brotlicffi, Envoy, Istio, cdxgen, PHP Windows builds, ClickHouse, Ruby brotli gem

Only if

• Brotli: the application decompresses attacker-controlled Brotli data, for example via node:zlib or Express 5 default JSON body parsing (per exposure data)
• ELLIO reproduced code execution on x86-64 with node:http, a slim image, Express 5.3.0 and Koa 3 (per change feed)
• PHP: Brotli reachable through cURL auto-decompression (per change feed; source not in set)

Not affected if

• Node.js service does not decode attacker-influenced Brotli (per exposure data)

Fixed in: Node.js 22.23.4, 24.22.1, 26.12.1; Brotli v1.2.1; PHP Windows packages 8.5.12-1, 8.4.27-1, 8.3.36-1, 8.2.35-1; Adobe APSB26-73 (per published card, change feed and exposure data; confirm with vendors). The sources do not state the SessionReaper fix version.

Enumerate

• All Node.js runtimes with exact version and CPU architecture, including containers, serverless and vendor appliances; flag 24.22.0 x86-64
• Other Brotli-embedding software (Bun, .NET, Python brotli/brotlicffi, Envoy, Istio, PHP on Windows, proxies) and the Brotli version each bundles. The change feed notes a public repo, trailofbits/brotli-checker, for finding vulnerable copies; review it before use
• Services that accept Brotli-encoded request bodies from untrusted clients
• All Magento / Adobe Commerce instances with patch level, including agency-hosted, vendor-hosted and acquired storefronts
• Admin accounts and creation dates on each Magento instance
• cms_block and cms_page entries that contain script references

Contain

• Preserve evidence first: snapshot affected hosts, the Magento database, the web root and access logs.
• Patch internet-facing Node.js and other Brotli-embedding services to fixed builds, starting with Node.js 24.22.0 x86-64 hosts (fixed versions per published card).
• Block 94.154.43.7 at the edge. This is reversible [S2][S5].
• Block the five loader domains at proxy and DNS, and in CSP where you control it [S3].
• Disable unrecognised Magento admin accounts and rotate all admin credentials. Disabling is reversible; deleting removes evidence, so wait until evidence is collected.
• Export injected CMS blocks before removing them. Once removed they cannot be recovered from the live system.
• Apply APSB26-73 and restrict Magento admin access by network where possible [S1].

Eradicate

• On Node.js hosts with a shell hit, find and remove what the shell dropped. The sources do not describe post-exploitation activity.
• Remove PNG-disguised webshells from pub/media/custom_options/quote/ [S4].
• Remove rogue admin accounts [S4].
• Remove the GSocket backdoor and look for its persistence. The sources do not describe that persistence [S3].
• Clean the loader out of cms_block and cms_page [S2][S3].

Recover

• Before restoring, confirm every exposed service runs fixed Node.js, Brotli and PHP builds.
• Before restoring Magento, confirm no CMS script references, unknown admins or upload-path files remain, and that APSB26-73 is applied.
• After restoring, monitor for shells under node, crashes after large Brotli requests, and traffic from new exploit sources.
• Monitor CSP reports and DNS for the loader domains and new rotating domains.
• Watch for new admin accounts and new files in pub/media/custom_options/quote/.

Re-enter the loop when

• New Node2Shell exploit sources, or ROP chains for other Node.js builds or architectures, are published.
• New loader domains are published; the domains are reported to rotate [S3].
• The next-stage Magento payload is recovered and described [S2].
• Another Brotli-embedding product is reported exploited.
• Adobe, Node.js, Google, PHP or another embedding vendor changes its advisory, fixed versions or workarounds.
• GSocket, a webshell or a node-spawned shell is found on a host already marked clean.

Debrief

• Record which services decoded untrusted Brotli, their build and architecture, and how long they ran unpatched after 2026-10-21.
• Record which initial access vector applied to each Magento instance: PolyShell, SessionReaper or rogue admin.
• Record dwell time between first exploit traffic or first CMS change and detection.
• Gap: the Magento next-stage payload has not been recovered, so data-theft impact is unknown [S2].
• Gap: the sources do not say how rogue admins were created on fully patched stores.
• Gap: GSocket persistence and Node2Shell post-exploitation activity are not described.

Detection coverage — checked automatically

Checked automatically 2026-11-10 13:46Z from public sources: 26 published, 19 nothing found, 0 not machine-checkable, 0 failed. "Nothing found" means the public source answered and had nothing, as of that moment; a feed covers only its newest posts. Re-checked daily.

Exposure queries — generated automatically

Where each CVE comes from: CVE-2025-54236 — Magento skimming-loader campaign infects 953 stores via PolyShell/SessionReaper and rogue admins; CVE-2026-48356 — Magento skimming-loader campaign infects 953 stores via PolyShell/SessionReaper and rogue admins; CVE-2026-111497 — Node2Shell (CVE-2026-111497) Exploited in the Wild Against Node.js v24.22.0 x86-64; Patch 24.22.1. A product row answers "is the software from that story reachable from the internet", not "is this card about that software".

vuln:CVE-2026-48356

vuln:CVE-2025-54236

vuln:CVE-2026-111497

cpe:"cpe:/a:nodejs:node.js"

product:"Node.js"

host.services: (software.product = "Node.js")

Internet-wide count, trend

Shodan's count of matching services on the whole internet, one point a day; the scope (your ranges) is never part of it. A count moves with Shodan's crawl as much as with patching, so read the direction, not the digit.

NVD names 29 more affected products (libraries and embedders); the CVE query covers them where Shodan has fingerprinted the version.

Banner spellings: a model read 2 from the NVD names and this card's text (former and marketing names, console titles); 0 matched something on Shodan and are shown above, the rest were dropped.

Scope every query in your own tool, never in a shared document: Shodan `net:<your_ranges>`, `org:"<your_org>"` or `hostname:<your_domain>` (or a Shodan Monitor network alert, which applies the scope for you); Censys `host.ip: <your_ranges>` or `host.dns.names: <your_domain>`. Then compare the banner version with the affected range. Generated automatically 2026-11-10 13:46Z from the CVE ids and NVD's CPE configurations, each Shodan query counted against Shodan itself; re-built daily with the coverage check.

Open questions

• The ELLIO in-the-wild report (2026-10-26, Node.js v24.22.0 x86-64) and ELLIO's four-setup reproduction have no URL in the source set. Add them before publishing.
• The change feed dates the CVE-2026-111497 KEV addition to both 2026-10-27 and 2026-10-28. Confirm the dateAdded on the KEV entry [S1].
• The change feed says a source lists Node.js workarounds, but the text is truncated. The published card said none exist. Confirm the workarounds and their source.
• The PHP rebuild note mentions Guzzle but is truncated. Confirm whether Guzzle-based apps are reachable and which PHP source says so.
• Early campaign iterations reportedly used the Keitaro tracker as a traffic distribution system. The change feed does not name the page; confirm before adding.
• Today's story priority names PAN-OS as a Brotli embedder. No source in the set supports it; confirm with Palo Alto Networks before adding to scope.
• The input behaviors block attributes campaign and honeypot quotes to S1 (CISA KEV). They appear to come from S2 and S5; the card cites those instead.
• S5 is a honeypot RCE report under a php2shell path. Confirm which claims it supports (Node2Shell shell outcome versus Magento artifacts) before publishing; the prior draft's 2026-09-16 and 2026-09-24 store events were dropped pending that check.

Sources

• [S1] https://www.cisa.gov/known-exploited-vulnerabilities-catalog · Cybersecurity and Infrastructure Security Agency (CISA)
• [S2] https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html · The Hacker News
• [S3] https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html · The Hacker News
• [S4] https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/ · SecurityWeek
• [S5] https://github.com/0x4D31/honeypot-data/blob/main/reports/php2shell/2026-10-24-confirmed-rce.md · GitHub

Public OSINT only. AI-generated by the pipeline; structure follows the DAIR model from Dynamic Incident Response (Joshua Wright). Published automatically once it crosses the publish bar.