Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Monday 2 November
Global

Your region, kept on this device.

Get the appSign in

CISA

Company

Security timeline

  1. Vulnerability reported by CSO OnlineCritical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV
  2. Vulnerability reported by Qualys Threat ResearchCISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue

Recent news

CSO Online· · Critical

Critical Brotli decoder flaw CVE-2026-111497 (Broccoli2Shell) exploited, added to CISA KEV

CVE-2026-111497, nicknamed Broccoli2Shell, is an out-of-bounds write in the Google decoder that can be exploited remotely without authentication. It can cause memory corruption, information disclosure, crashes or code execution. CISA added it to its Known Exploited Vulnerabilities catalogue on 27 October 2026. Software that bundles Brotli, including Node.js, .NET, PowerShell, , Envoy Proxy, Istio and Python packages, may be affected.

Am I affected?
Ask
5
Qualys Threat Research· · Critical

CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue

CISA added CVE-2026-111497 (Google , CVSS 9.2) and CVE-2026-48356 ( Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, and Microsoft .NET have released fixes for Brotli.

Am I affected?
Ask
9