Online shops that run on Adobe Commerce or Magento are facing a serious security threat. Reports say attacks known as PolyShell have compromised hundreds of online stores. The US Cybersecurity and Infrastructure Security Agency (CISA) has now added the related vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog.

If you run an online store, or shop on one, here is a clear guide to what happened, why it matters, and what to do next. For more security news, explore our Cybersecurity and Digital Economy sections at Jantarax Tech.

What Is PolyShell?

PolyShell is the name reported for a set of attacks against online stores built on Adobe Commerce. The source does not describe exactly how the attack works, so the technical details are not confirmed here. Check CISA’s and Adobe’s official notices for the most accurate description.

What the reports do say is that attackers have used these weaknesses to break into stores, leading to significant breaches in online retail environments.

What Are Adobe Commerce and Magento?

Adobe Commerce, which grew out of the Magento platform, is software that many businesses use to run online stores. It handles products, shopping carts, payments, and customer accounts. Because so many shops use it, a flaw in the software can affect a large number of businesses at once. That makes it an attractive target.

What Is the Brotli Decoder?

Brotli is a compression method created by Google. It shrinks data so websites load faster. A decoder is the part of software that unpacks that compressed data. Many applications use Brotli in the background, so a weakness in the library can ripple into the software that depends on it. This is general background, not from the announcement.

What Did CISA Confirm?

CISA has confirmed two critical vulnerabilities affecting:

  • Adobe Commerce and Magento
  • Google’s Brotli decoder library

One is identified as CVE-2026-111497. The source does not name the second. Both have been added to CISA’s KEV catalog.

Why Does the KEV Catalog Matter?

CISA’s Known Exploited Vulnerabilities catalog is a list of flaws that attackers are known to be using in real attacks. Being on the list is a strong warning sign. It means the risk is not theoretical.

US federal agencies are generally required to fix KEV entries within set deadlines, and many private companies use the list to decide what to patch first. If a flaw you use is on the list, treat it as urgent.

How Serious Is It?

The reported severity score is 9.2, which falls in the critical range. CVSS scores run from 0 to 10, and higher numbers mean greater potential damage and easier exploitation.

The source says the weaknesses involve unchecked return values. In simple terms, software sometimes asks another part of the system to do something and then fails to check whether it worked. Attackers can take advantage of that gap, which may lead to unauthorized access and data breaches. This is a plain-language summary of the source’s description, not a technical analysis.

What Could Attackers Do to a Store?

The source says the breaches could lead to unauthorized access and the exposure of customer data. In general, attacks on online stores can lead to:

  • Stolen customer details, such as names, addresses, and emails.
  • Payment data theft, where attackers capture card information at checkout.
  • Fake pages or hidden code that trick shoppers.
  • Loss of trust and possible fines or legal trouble for the business.

The reports do not say which of these happened in the PolyShell cases, so treat these as general risks.

What Should Store Owners Do Now?

Businesses using Adobe Commerce and Magento are advised to watch their systems closely, apply security patches, and review access logs. Here is a practical checklist:

  1. Apply the latest patches from Adobe for Adobe Commerce and Magento.
  2. Update any components that use Brotli, following vendor guidance.
  3. Review access logs for unusual logins, new admin accounts, or odd file changes.
  4. Scan your site for unknown files or injected code, especially in checkout pages.
  5. Reset admin passwords and turn on multi-factor authentication.
  6. Limit admin access to only the people who need it.
  7. Back up your store before and after patching, and keep backups offline.
  8. Talk to your hosting provider or a security professional if you suspect a compromise.
  9. Follow CISA’s updates, since more guidance may come as investigations continue.

Steps 4 to 9 are general best practices, not instructions from the report.

What Should Shoppers Do?

You can’t see how a store is built, but you can lower your own risk:

  • Use a credit card or a trusted payment service instead of a debit card when possible.
  • Check your statements for charges you do not recognize.
  • Use unique passwords for each shop, and a password manager.
  • Be careful with emails about “order problems” or “account issues,” since attackers sometimes follow breaches with phishing.
  • If a store notifies you of a breach, follow its advice and consider changing your passwords.

A Pattern of Serious Security Incidents

PolyShell is part of a larger wave of attacks on the systems we depend on. See our coverage of the Revolut data breach caused by fake government requests and the TP-Link router ban and state lawsuits. Defenders are using new tools too, such as Anthropic’s free AI vulnerability scanner for open-source projects.

Small online shops often run lean, so staying secure matters just as much for them. Our guide on how small businesses are saving time with AI shows how smaller teams can do more, but security should stay a priority.

What Happens Next?

As investigations continue, expect more details about how many stores were hit, how the attackers got in, and what fixes are available. CISA’s involvement suggests more guidance may follow.

Things to watch include:

  • Official advisories and patches from Adobe.
  • Updates from CISA on the KEV entries and deadlines.
  • Fixes for the Brotli library and the software that uses it.
  • Reports from affected stores about what data was exposed.
  • Further attack waves that target unpatched sites.

Frequently Asked Questions

What are PolyShell attacks?
Attacks that have reportedly compromised hundreds of online stores running Adobe Commerce or Magento.

What is CISA’s KEV catalog?
A list of vulnerabilities known to be exploited in real attacks.

What is the CVE number?
CVE-2026-111497 is one of the two flaws. The source does not name the other.

How severe is it?
The reported CVSS score is 9.2, which is critical.

Which products are affected?
Adobe Commerce, Magento, and Google’s Brotli decoder library.

What should I do first?
Apply the security patches and review your access logs.

Conclusion

The PolyShell attacks are a stark reminder that popular e-commerce platforms can become high-value targets. For store owners, the message is clear. Patch fast, check your systems, and keep watching for suspicious activity. For shoppers, staying alert to unusual charges and phishing helps limit the damage.

For more updates, learn about Jantarax Tech or contact our team with tips and feedback.