s currently not known if these efforts are broad in scope. This is indicative of the RCE being adopted by an operator focused on mass exploitation. Node.js fixed the vulnerability in versions 22.23.4, 24.22.1, and 26.12.1, Node2Shell is not a bug in every Node.js service, but a bug in services that decode attacker-influenced Brotli, The development comes days after Sansecsaidit observed attackers leveraging CVE-2026-48356, also known as PolyShell, to breach hundreds of e-commerce stores to inject a malicious loader via a Magento CMS block.