Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

The U.S. CISA added two critical vulnerabilities—CVE-2026-111497 in Google's Brotli decoder and CVE-2026-48356 (PolyShell) in Adobe Commerce/Magento—to its Known Exploited Vulnerabilities list. PolyShell attacks have breached hundreds of e-commerce stores since mid-2025, injecting malicious loaders, while Broccoli2Shell exploit attempts have been detected recently, indicating ongoing threats.