Magento vulnerability PolyShell joins CISA list: check your store

PolyShell lets someone upload a file to a store without logging in. The trick is in the name: it uses a polyglot file, one built to look like an ordinary image while also working as a script. Magento’s REST API, the interface apps use to talk to the store, accepted these uploads as part of a cart item’s custom options and saved them on the server.

Depending on how the web server is set up, that can let an attacker run their own code on the store or take over accounts. Sansec, the Dutch e-commerce security firm that named the flaw in March, warned back then that exploit methods were already circulating and that automated attacks would follow. They did.

Adobe’s first fix only shipped in a test release, leaving live stores exposed for a while. Adobe has since released a PolyShell fix for its supported release lines, but stores that haven’t installed it remain open.

Sansec says one group has infected 953 online stores, most of them on Magento. About 471 were injected through PolyShell, and roughly another 100 had files uploaded through PolyShell or an older Magento flaw called SessionReaper.

The attackers add a small loader to a store’s content blocks, the reusable chunks of text and code behind headers, footers and banners. When a shopper opens the page, their browser quietly asks the attacker’s server what to do next. That server checks whether the visitor is a real person or a security scanner, and scanners get nothing back. That’s why infected stores can pass routine checks.

• The group has rotated through five loader domains, the latest registered on October 6, 2026.
• That newest domain had turned up on 83 stores, 60 of which already carried older versions.
• One version stores the malicious code in the shopper’s browser, so it runs again on later visits even if the attacker’s server goes offline.
• Sansec’s monitoring service logged about 52,000 visitor browsers loading one earlier domain alone.

Nobody has captured the final payload yet, so it’s not clear whether this campaign steals card numbers, logins or something else. Earlier versions of the loader sent visitors scripts from crypto-themed domains, including one imitating the Ledger hardware wallet brand. That points toward wallet scams or fake prompts rather than classic card skimming, but it isn’t confirmed.

You can’t easily tell if a store is infected, because the whole point is to look normal. Sensible habits help:

• Be suspicious of any pop-up on a shopping site that asks you to connect a crypto wallet, download something or re-enter details you didn’t expect to give.
• Check your card statements regularly, especially after buying from small independent stores.
• If your bank or card offers one-time or virtual card numbers, use them for unfamiliar shops.

The uncomfortable detail is that patching alone isn’t enough. Sansec found one store with no missing core patches that still got the newest loader, an hour after a clean scan. Weeks earlier, a rogue administrator account and a backdoor had been planted on it. Attackers who already got in kept their access after the hole was closed.

1. Install Adobe’s PolyShell fix for your release line, and any other outstanding Magento security updates.
2. Audit admin accounts. Remove anything you don’t recognize and change every admin password.
3. Check your content blocks. Look in the cms_block and cms_page database tables for script tags or code you didn’t add.
4. Lock down the upload folder. Restrict web access to pub/media/custom_options/ and confirm your nginx or Apache rules really block it.
5. Scan for shells and backdoors, including files disguised as PNG images in that upload folder.

If you rely on an agency or a hosting company to look after your store, ask them directly whether these checks have been done. Many small shops run on a setup their host chose, and Sansec has said that’s often where the exposure comes from.

CISA added another flaw at the same time, in Google’s Brotli decompression library, which is used by Node.js, PHP, Python and many other projects. Rated 9.2, it can let an attacker crash a service or, in narrower setups, run code by sending specially crafted compressed data. Exploit traffic has already been spotted. Node.js says upgrading is the only complete fix, and a long list of vendors has issued patches or advisories.

US federal civilian agencies have until November 10, 2026, to fix both flaws. That deadline only binds government systems, but it’s a good benchmark for everyone else.