Magento PolyShell joins CISA's exploited list, seven months after the first attacks

On 27 October 2026 CISA (the US government's cybersecurity agency) added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog, the list of flaws it has evidence attackers use ¹. The flaw, which the security firm Sansec named PolyShell, lets a stranger who has not logged in upload a file of their choosing to a Magento or Adobe Commerce shop ⁶. Sansec recorded the first attacks on 19 March 2026 ⁶. Read this morning, 28 October, Adobe's bulletin still says Adobe is "not aware of any exploits in the wild" ³.

Magento Open Source is the free shop software; Adobe Commerce is the paid edition of the same code. A CVE number is the public ID of one flaw. A webshell is a small program an attacker leaves on a server to run commands on it later.

The guest cart accepts a PHP file dressed as a picture

Magento lets a product carry a "file" option, such as a logo for a printed mug. Its REST API (the address apps use to talk to the shop) takes that file inside a cart request, as base64 text with a name and a type, and writes it to pub/media/custom_options/quote/ ⁶. Two routes for guest carts, POST /V1/guest-carts/:cartId/items and PUT /V1/guest-carts/:cartId/items/:itemId, need no login. GraphQL, the shop's other API, takes a different path and is not affected ⁶.

Sansec lists three missing checks: the option ID is not matched to the product, the upload runs whether or not the product has a file option, and .php, .phtml and .phar names pass. The only test is whether the bytes start like an image, and a polyglot (a file that is a valid GIF and valid PHP at once) passes it ⁶. Whether the uploaded PHP then runs depends on the web server: stock nginx setups for Magento 2.0 to 2.2, nginx configured to hand every .php request to PHP, and Apache before 2.3.5 without php_flag engine 0 ⁶.

Seven months from first attack to the exploited list

Between 12 May and 14 July, a shop on 2.4.8 or older had no fix from Adobe short of a move to 2.4.9 ⁶. Sansec does not say which set of stores its 82% is a share of ⁶.

Adobe's bulletin rates the flaw Critical, priority 2, with a CVSS 3.1 score of 9.6 out of 10 ³; NVD, the US vulnerability database, lists 9.3 with the same attack path but no harm to uptime ⁵. Both mark it as needing no login ³⁵. The CISA feed marks ransomware use as unknown ².

A patched store can still carry the attacker

Patching closes the door; it does not remove what came through it. Sansec found an attacker's script in the content blocks of 83 stores in October, loaded from deepveindrilling.com, and counts 953 stores hit by the same operator since July 2025 ⁸. The script lives in the database table cms_block, the static blocks Magento prints into shop pages, and keeps a copy of itself in the shopper's browser storage, so it runs again even when its home domain goes down ⁸. On 23 October it began collecting details of each visitor's device and sending nothing to automated browsers, which hides it from many scanners ⁸. Of 169 infected Magento 2 installs missing at least one core patch, 102 also held files uploaded through PolyShell or SessionReaper, an older Magento flaw fixed in APSB25-88 ⁸.

Four checks, then the patch

Run these from the shop's root folder. The first two look for files, the third for the script in the database, the fourth for admin accounts you did not make ⁶⁸.

find pub/media/custom_options/ pub/media/customer_address/ -type f ! -name '.htaccess'
find . -name 'accesson.php' -type f

Any .php, .phtml or .phar file in pub/media/custom_options/ marks a break-in ⁶. accesson.php is a backdoor the March attackers planted under assets/images/ in many top folders (app/, lib/, pub/, vendor/ and others) ⁶.

SELECT block_id, identifier, update_time FROM cms_block
WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%'
   OR content LIKE '%localStorage.getItem%';
SELECT user_id, username, email, created FROM admin_user ORDER BY created DESC;

Run the first query on cms_page too, and add your table prefix if the shop uses one; update_time shows the attacker's last write ⁸. If any check finds something, deleting the script is not the end: Sansec states the attacker keeps database access, and lists new database, admin and API integration passwords as the next step ⁸.

The patch: APSB26-73 ships a zip per version line, and each applies only to the newest security release of its line, so a shop first moves to 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 or 2.4.4-p18 ⁴. The bulletin fixes 14 flaws, not only this one, and its list of affected versions includes 2.4.9; the zip for 2.4.9 is 2-4-9-jul-2026.zip ³⁴. On Adobe Commerce Cloud the fix also comes in the latest cloud-patches update, and Adobe notes that applying the isolated patch on top can make installation fail ⁴.

Until the patch is in, block the upload folder

Sansec's server rules stop an uploaded PHP file from running; they do not stop the upload, which only a firewall rule on the API call itself does ⁶. For nginx, placed before any \.php$ block:

location ~* ^/pub/media/custom_options/ {
    deny all;
    return 403;
}

For Apache, pub/media/custom_options/.htaccess holds:

<IfModule mod_php.c>
    php_flag engine 0
</IfModule>
Deny from all

On a hosted shop, the host or agency runs these steps; the questions to send them are the Magento version with its -p number, whether APSB26-73 is applied, and what the four checks returned.