The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two actively exploited flaws to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-48356, an unrestricted file-upload vulnerability in Adobe Commerce and Magento that enables arbitrary code execution, and CVE-2026-111497, an unchecked return-value bug in Google’s Brotli decoder that can corrupt memory, disclose data, cause denial-of-service, or trigger remote code execution. Sansec reported that attackers have been using CVE-2026-48356, dubbed PolyShell, to breach hundreds of e-commerce stores since at least July 2025, injecting a malicious Magento CMS block that fetches an attacker-controlled payload. Meanwhile, ELLIO observed exploitation traffic for CVE-2026-111497 from a Netherlands-based IP (94.154.43[.]7), confirming a working Node2Shell exploit against vulnerable Node.js builds. Vendors including Node.js, PHP, Bun, Envoy Proxy, and .NET have issued patches, and FCEB agencies must remediate by November 10, 2026. 1