US officials say attackers are exploiting flaws in Adobe Commerce, Magento and the Brotli tool, and hundreds of online stores have already been breached.
Hundreds of online stores built on Adobe Commerce and Magento have been breached, according to security firm Sansec. On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of vulnerabilities known to be under attack. It added a second flaw, in a data-shrinking tool called Brotli, to the same list.
The store attacks use a flaw called PolyShell. Sansec says attackers slipped a hidden loader into stores through a Magento content block, which is a piece of page content that store owners manage. The loader is built to download and run code chosen by the attacker. No follow-up code has been recovered, so the attackers' goal is still unclear. The activity appears to have been going on since at least July 2025.
The second flaw sits in Brotli, a widely used tool that compresses data so it moves faster. Security firm Rapid7 says an attacker who feeds crafted Brotli data to an affected Node.js app can corrupt its memory. That can crash the app, leak sensitive information or let the attacker run their own commands.
Reports so far are mixed. Previdian recorded one attempt against its decoy systems from a US address as of October 27, 2026. Another firm, ELLIO, saw exploit traffic from an address in the Netherlands. ELLIO says the attack was correctly built and suggests an operator focused on mass exploitation. That same address also targeted two serious flaws in PHP.
Store owners on Adobe Commerce or Magento are the most exposed to PolyShell. The Brotli flaw reaches further, because many projects use it. PHP, Node.js, Bun, Envoy Proxy, Istio, .NET, Python, ClickHouse, the PHP Brotli extension and the Ruby brotli gem have all had patches or reviews. Node.js fixed it in versions 22.23.4, 24.22.1 and 26.12.1, and offers no workaround. Wiz says 91% of cloud environments have resources vulnerable to it.
Not every Node.js site is at risk. Security firm Sysdig says the bug matters only in services that unpack Brotli data an outsider can influence. So far it reports crashes at scale, and code execution only in a narrow setup. Sysdig advises fixing the most reachable systems first. Still, the Node.js fix is the only complete remedy.
The alert box above lists the steps. In short, update first, then have a developer check your store for anything unfamiliar.
US federal civilian agencies have until November 10, 2026, to apply the fixes. Private businesses face no such deadline, but the attacks are already underway. What the PolyShell attackers want, and how widely the Brotli flaw will be used, is not yet known.
If you run an online store or a Node.js or PHP site, install the latest updates now and have a developer check for unfamiliar code.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youTuring Award winner Richard Sutton says more computing power alone will not make AI truly smart. Big AI companies disagree, which matters for anyone betting on AI.
Read more: AI pioneer says piling on computing power won't make machines smartMorristown police say scammers posing as bank staff are pushing people to withdraw cash, which is very hard to get back once it is handed over.
Read more: Morristown police warn of scam where fake bank staff ask for cash
