Attackers are uploading web shells to Magento stores through the shopping cart. Install Adobe’s July fix and check for intruders

A Magento store can be broken into through its own shopping cart. PolyShell lets anyone with no account upload a file through the guest-cart API, and on many web server setups that file runs as code. On Tuesday CISA added the flaw to its list of exploited vulnerabilities and gave federal agencies until November 10 to fix it.

Sansec, which found and named the bug in March, says one criminal group has used it to plant skimmer-style loader code on online stores, and that patching alone has not kept every store clean.

PolyShell lets a stranger upload a web shell through a Magento store’s shopping cart. CISA now lists it as exploited, and Sansec found the loader back on a fully patched store an hour after a clean scan.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

CISA lists the PolyShell cart upload flaw as exploited

CISA added CVE-2026-48356, an unrestricted file upload flaw in Adobe Commerce and Magento Open Source, to the Known Exploited Vulnerabilities catalog on October 27. The federal due date is November 10. Adobe fixed it on July 14 in bulletin APSB26-73 and rates it critical with a CVSS score of 9.6; the bulletin, last updated August 11, still says Adobe is not aware of exploits.

Sansec’s write-up explains the bug. Magento’s REST API accepts a file as part of a cart item’s custom options and writes it to pub/media/custom_options/quote/. It never checks that the product has a file option and never blocks .php, .phtml or .phar files; the only test is an image header, which a polyglot file passes. The anonymous routes POST /V1/guest-carts/:cartId/items and PUT /V1/guest-carts/:cartId/items/:itemId need no login.

Sansec reported attack attempts against 79.5% of the stores it protects by March 30. On October 24 it tied a loader campaign on 953 stores, mostly Magento, to the same group, including 471 stores injected within one hour in March after web shells were uploaded through PolyShell.

Magento stores that skipped the July update, and some that did not

Any store on Magento Open Source or Adobe Commerce that has not installed the July 2026 release is exposed to the upload. Whether the uploaded file runs depends on the web server: Sansec lists stock nginx on Magento 2.0 to 2.2, any nginx setup that passes every .php file to PHP, and older Apache setups without php_flag engine 0. Even when the file cannot run, it stays on disk and can turn dangerous after a server move or config change.

Patching does not remove an intruder. Sansec found the newest loader on a Magento 2.4.7-p10 store with no missing core patches on October 23, one hour after it passed a clean scan; the store had a rogue admin account from September 16 and a GSocket backdoor from September 24. The loader lives in the cms_block database table, so deleting the script leaves the attacker’s database access in place.

Install Adobe’s July release, then hunt for shells and loader code

• Install the APSB26-73 release for your line: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul or 2.4.6-2026-jul for Magento Open Source, with 2.4.5-2026-jul and 2.4.4-2026-jul also available for Adobe Commerce. Older lines have no fix.
• Block web access to pub/media/custom_options/. On nginx, Sansec’s rule (location ~* ^/pub/media/custom_options/ { deny all; return 403; }) has to sit before any \.php$ block. On Apache, confirm the folder’s .htaccess has php_flag engine 0 and Deny from all.
• Ask your hosting provider or agency which web server rules the store actually runs, since Sansec found most stores use the host’s config rather than Adobe’s sample.
• If you find any sign of compromise, clean up first and then change the database, admin and API integration passwords.
• If you own the web server config and want a grounding in hardening habits like these, our GSEC exam guide covers the basics.

Details

• CVE: CVE-2026-48356, unrestricted upload of file with dangerous type (CWE-434), no authentication required, CVSS 9.6 (Adobe). Added to CISA KEV October 27, 2026; due November 10, 2026.
• Affected (Adobe): Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier; Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier. GraphQL mutations use a different code path and are not affected (Sansec).
• Same campaign: Sansec also found files uploaded through SessionReaper, CVE-2025-54236. Of 169 infected Magento 2 installs missing at least one core patch, 102 showed PolyShell or SessionReaper uploads. The fix for SessionReaper is APSB25-88.
• Loader domains (Sansec): deepveindrilling[.]com (registered October 6, on 83 stores), additionalver[.]com, lanhd6549tdhse[.]top, neswnsssn[.]click, manulfie[.]click.

Hunt / verify

• List what is in the upload folders: find pub/media/custom_options/ pub/media/customer_address/ -type f ! -name '.htaccess'. Any .php, .phtml or .phar file there is a strong sign of compromise.
• Search the whole web root for the follow-on backdoor: find . -name 'accesson.php' -type f. Sansec found copies in assets/images/ folders under most top-level directories.
• Query the CMS tables for the loader: SELECT block_id, identifier, update_time FROM cms_block WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%' OR content LIKE '%localStorage.getItem%'; and run the same on cms_page.
• Check admin_user for accounts nobody recognizes, and web logs for POST or PUT requests to /V1/guest-carts/ carrying file_info.

Source: CISA KEV addition, October 27; Sansec: how to check your store

Sources

• CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (October 27, 2026)
• CISA Known Exploited Vulnerabilities Catalog
• Adobe: Security update available for Adobe Commerce, APSB26-73
• Sansec: PolyShell, unrestricted file upload in Magento and Adobe Commerce
• Sansec: deepveindrilling.com, Magento CMS block loader hits 953 stores
• The Hacker News: Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento
• Infosecurity Magazine: Hackers Infect 953 Online Stores With Scanner-Evading Code

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].