The Brotli flaw dubbed "Broccoli2Shell" is already under attack. Attackers are also exploiting a vulnerability in Adobe Commerce and its open-source sibling Magento. The US agency CISA has added both to its Known Exploited Vulnerabilities catalog.
Adobe Commerce and Magento
Shop operators should check that they have installed updates from July 2026 or later. The exploited flaw (CVE-2026-48356, CVSS 9.3, critical) allows unrestricted upload of files with dangerous types, which makes it possible to run code in the context of the current user account. Attackers can also use it to escalate privileges or take over accounts and sessions. According to Adobe, victims have to visit a malicious URL or interact with a compromised website for this to work.
CISA gives no details about the attacks. The security firm Sansec, however, has analyzed a campaign: the group has compromised at least 953 shops since July 2025, mostly running Magento. In March it used the flaw known as "PolyShell" to upload web shells.
Brotli becomes Broccoli2Shell
The flaw was first called "node2shell". Since the start of this week, it has been clear that it does not only affect Node.js but anything that uses Brotli libraries to decode the compression format. That is how it got its tongue-in-cheek new name, "Broccoli2Shell".
Unauthenticated attackers can abuse CVE-2026-111497 (CVSS 4.0: 9.2, critical) with crafted data streams, for example to inject malicious code. According to CISA, this is now happening in the wild. Affected are Brotli versions 1.0.3 through 1.2.0. The fixed releases are 1.0.10, 1.1.1 and 1.2.1. If you find vulnerable libraries, update them and treat the affected systems as compromised. CISA does not say how widespread the attacks are, but the measures are urgent regardless.
Little time to patch
Rapid7 has just published its threat landscape report for the third quarter. According to it, serious vulnerabilities now see attack attempts three days after disclosure on average, and 71 percent of observed exploit attempts happened within the first seven days. Leaving patches on the shelf means betting on time you do not have.