Vulnerability ManagementAttack SurfaceThreat Intelligence
On 27 October 2026, CISA added two web-stack flaws to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-111497, a Brotli decoder bug that affects Node.js, and CVE-2026-48356 (PolyShell), an unauthenticated file-upload flaw in Adobe Commerce and Magento. Both have vendor fixes. Both are now on the list of bugs federal agencies must remediate, and both show why a published patch does not tell you that your estate is safe.
The Node.js flaw is tracked as CVE-2026-111497 and nicknamed Node2Shell. CISA scores it as critical, and Help Net Security reports that it is under active attack. It is a buffer overflow in the Brotli decoder, which is compiled into the Node.js runtime itself. Fixed releases are 22.23.4, 24.22.1 and 26.12.1.
That placement causes the detection problem. The npm package named brotli is unrelated, so a dependency scan of your package.json files will not flag a vulnerable server. Node.js 20 and older are end-of-life and will not receive the fix. Imperva's research showed code execution on the official Node.js image through fetch() and Express 5, though the attack needed several attempts. Sources disagree about how far exploitation has gone, so treat the KEV listing as the reliable signal and do not rely on any single public proof of concept.
PolyShell, CVE-2026-48356, lets an unauthenticated attacker upload dangerous files through the guest cart REST API in Adobe Commerce and Magento. CISA gave it a federal remediation deadline of 10 November 2026. The Hacker News reports that attackers used it to breach hundreds of e-commerce stores and inject a malicious loader through a Magento CMS block. Adobe fixed the flaw in APSB26-73 in July, so the stores that were breached were mostly unpatched.
The more important detail is reinfection. Some stores that had applied the fix were compromised again through rogue admin accounts the attacker had already created. Patching closes the door. It does not remove what the attacker left inside.
package.json. Node.js 20 or older needs a migration plan, not a patch.Scout is Obiguard's external attack surface product. It maps what your organisation exposes to the internet, including hosts, software versions and look-alike domains, and it watches that inventory for change. For Node2Shell and PolyShell, the useful output is a list of which public hosts run a vulnerable Node.js release or a Magento store, so you can patch and check for reinfection in the right order. You can start with a free Scout check on any domain you own, which shows the hosts already published under it and their posture. Our SOC product covers the detection side once an exposed host is found.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →