What happened
Adobe Commerce and its free edition, Magento Open Source, are among the most widely used e-commerce platforms. They contain a flaw, CVE-2026-48356, which the security firm Sansec named PolyShell. It lets an attacker upload a dangerous file, such as a PHP script, to the server and then run it.
Adobe fixed the flaw on July 14, 2026, with security update APSB26-73. The US National Vulnerability Database (NVD) published it the same day. Attackers had been exploiting it for months by then. Sansec raised the alarm in March 2026, and on March 30 it described a mass attack wave in which 471 stores were compromised within a single hour.
The US agency CISA added the flaw to its catalog of actively exploited vulnerabilities on October 27, 2026. The European ENISA EUVD database also lists it as exploited. According to Sansec, a campaign that uses PolyShell among other flaws has hit 953 stores since July 2025, mostly running Magento. The attackers switch the domains that serve their malicious code every few months. Since October 2026 they have used deepveindrilling.com.
Why it is dangerous
This is an “unrestricted file upload” flaw. Picture a mailroom that is supposed to accept only photos but never checks what people hand in. An attacker slips in a program instead of a picture, and the server later runs it. On compromised stores, Sansec found webshells (scripts that give remote control over the server) disguised as PNG images.
The attack works over the internet and requires no admin login. The NVD rating says some user interaction is required, but in practice Sansec documented automated mass attacks. Once in control of the server, the attacker can write to the database, create admin accounts and inject malicious JavaScript into store pages that runs in shoppers’ browsers.
According to Sansec, shoppers on infected stores were also served malicious content from leqdger.click, a domain imitating the Ledger crypto wallet brand. So the risk goes beyond store data. It reaches your customers and your reputation too.
What the numbers next to this article mean:
- CVSS 9.3 out of 10 (rating assigned by Adobe): critical severity, the highest category.
- CISA KEV: a catalog of flaws that the US agency CISA knows are being exploited in the wild. US federal agencies must fix this one by November 10, 2026.
- EPSS of about 59%: the estimated probability of exploitation within the next 30 days. Fewer than 1% of all scored vulnerabilities rank higher.
Who is affected
This affects online stores running Adobe Commerce or Magento Open Source that do not have security update APSB26-73 installed. Even the latest releases, such as 2.4.9 or 2.4.7-p10, are vulnerable. According to NVD, the Adobe Commerce B2B and Adobe Commerce Events extensions are affected as well. For example, Sansec found webshells on a store running version 2.4.7-p1.
Typical setups are stores on their own server, a VPS or shared hosting, often maintained by an external agency. If a contractor runs your store, ask them directly whether and when they installed APSB26-73.
Stores on other platforms are not affected. Be aware that patching alone is not enough if the store was breached earlier. Sansec saw an infection on a store running 2.4.7-p10 with all security patches applied. The attacker already had their own admin account and a backdoor there.
How to check if you are affected
You can see the version in the footer of the Magento admin panel, or on the server in the store directory with a command that changes nothing:
bin/magento --versionTo check whether a malicious script has been injected into the store, run these read-only database queries. Add your table prefix if you use one. The update_time column shows when the content was last changed.
SELECT block_id, identifier, update_time FROM cms_block
WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%'
OR content LIKE '%localStorage.getItem%';
SELECT page_id, identifier, update_time FROM cms_page
WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%'
OR content LIKE '%localStorage.getItem%';To look for suspicious uploaded files and known backdoors, run these commands in the store directory:
find pub/media/custom_options/ pub/media/customer_address/ -type f ! -name '.htaccess'
find . -name 'accesson.php' -type fHow to fix it
The fix is Adobe security update APSB26-73 for supported release lines. Work in this order:
- Back up files and the database, and if possible take a snapshot of the whole server.
- Check whether the store is already compromised (see the sections on checking and on compromise). Patching does not remove backdoors or injected scripts.
- Test the update on a staging copy of the store.
- Install APSB26-73 on the live store following the Adobe bulletin and flush the cache with
bin/magento cache:flush. If your store runs a release that is no longer supported, plan a move to a supported version as soon as possible. - Also install APSB25-88, which fixes another exploited flaw called SessionReaper (CVE-2025-54236). According to Sansec, attackers use both flaws to get their files onto the server.
Until you can patch, a web application firewall can help. Sansec says its Sansec Shield blocks both PolyShell and SessionReaper attacks. It does not replace the update, though.
What if you may already be compromised
If your store loads any of the known attacker domains, the attacker can write to your database. Deleting the script alone does not remove that access. Look in particular for:
- scripts in the
cms_blockandcms_pagetables referencing deepveindrilling.com, additionalver.com, lanhd6549tdhse.top, neswnsssn.click, manulfie.click, hdfdsi84j3h.top or c85grt98sd.com, often base64-encoded - files in
pub/media/custom_options/andpub/media/customer_address/, such as webshells disguised as PNG images - files named
accesson.php - unknown accounts in the
admin_usertable and unfamiliar processes on the server (Sansec also found a GSocket backdoor)
SELECT user_id, username, email, created, logdate FROM admin_user ORDER BY created DESC;After cleanup, change the database, admin and API integration passwords. If you find even one of these signs, bring in an e-commerce security specialist. Attackers keep coming back to the same stores. If customer personal data may have leaked, check your obligation to notify the data protection authority within 72 hours.