CISA Says Attackers Are Using a Magento Store Flaw and a Node.js Compression Bug: A Checklist for Online Stores and Customer Portals

On Oct. 27, 2026, CISA added two flaws to its Known Exploited Vulnerabilities list, which means it has evidence that attackers are using them right now. One is in Adobe Commerce and Magento, the software behind many small online stores and parts catalogs. The other is in Brotli, a compression library built into Node.js and other tools that power custom web apps, customer portals and online forms. Federal agencies have until Nov. 10 to fix both. Private businesses aren't bound by that date, but it's a good one to borrow.

CISA hasn't said whose exploitation evidence it relied on, and it lists ransomware use for both as "unknown." No named small-business victim has been reported. What's known is enough to act on: both flaws have fixes, and the checks below take one email or phone call to your web developer or host.

What's been reported

Magento "PolyShell" (CVE-2026-48356). CISA describes it as an "unrestricted upload of file with dangerous type" flaw in Adobe Commerce and Magento that could lead to arbitrary code execution. Security firm Sansec, which named the bug in March, says attackers can upload a file disguised as an image through the store's REST API without logging in, and that it has observed attacks on 79.5% of all stores. Whether an uploaded file can actually run depends on how the store's web server is set up.
The fix. Adobe fixed the flaw in Magento 2.4.9, and, according to ctxsec's summary of Adobe bulletin APSB26-73, in July 14, 2026 security releases for older supported versions (2.4.8, 2.4.7, 2.4.6, and Commerce 2.4.5 and 2.4.4). Sansec warns that patching doesn't remove a file an attacker already uploaded.
Brotli decoder bug (CVE-2026-111497). The Node.js project says malformed compressed data can write past the end of an internal buffer, which "can lead to a crash, disclosure of process memory, or remote code execution" in apps that decompress Brotli data with Node's built-in zlib. It affects Node.js 22, 24 and 26 and is fixed in 22.23.4, 24.22.1 and 26.12.1, released Oct. 21. Other software that bundles the decoder, such as .NET and Envoy, may need its own update.

Why it matters for a small business

A manufacturer, distributor or exhibit and display builder that sells parts, supplies or rentals online may be running Magento without thinking about it, because a web agency set it up years ago. An attacker with a file on that server can change pages, plant a card skimmer on checkout or use the server to reach other systems. According to ctxsec, Sansec has tied a card-skimming campaign on hundreds of stores to this bug.

The Node.js bug matters to anyone with a custom-built web app: an online patient intake or scheduling form at a dental or medical practice, a client document portal at a law or accounting firm, a donor or volunteer site at a nonprofit, or an order-status page at a shop. You may not know what it's built on. Your developer does.

Clear takeaway

Ask whoever runs your website two questions this week: "Do we run Magento or Adobe Commerce anywhere, and is it on 2.4.9 or a July 2026 security release?" and "Does anything we use run Node.js, and is it on 22.23.4, 24.22.1, 26.12.1 or later?" Get both answers in writing.

What to do this week

List your web systems. Write down your website, online store, customer or patient portal, and any online forms, plus who built and who hosts each one.
Patch Magento or Adobe Commerce. If you run either, have your developer install 2.4.9 or the July 2026 security release for your version, then confirm the version number in writing.
Check for uploaded files. Patching doesn't clean up. Ask your developer or host to look for PHP or disguised image files in the store's pub/media/custom_options/ folder, check for admin accounts nobody recognizes and review recently changed content blocks, as Sansec and ctxsec recommend. Sansec also recommends blocking web access to that folder.
Watch your checkout. If you take cards online, ask your payment processor or developer to confirm the checkout page hasn't changed and that no unknown scripts load on it.
Update Node.js. Ask your developer whether any app, portal or form runs on Node.js, and update it to 22.23.4, 24.22.1, 26.12.1 or later. Apps packaged in containers need to be rebuilt, not just restarted.
Ask about other software. Ask your IT provider whether any other server software you use bundles Brotli (for example .NET apps or Envoy) and whether its vendor has shipped an update.
Keep the evidence. If anything looks wrong, don't delete it first. Save copies and get help, since a planted file or skimmer may mean customer data needs a closer look.

How Brotherly Technology can help

Brotherly Technology can find out what your website, store and portals run on, work with your developer or host to confirm the Magento and Node.js updates are in place, and check for leftover files, unknown admin accounts and checkout changes. If you're not sure who built your site or what's under it, call us and we'll sort it out.