Magento shopsare under attack.Magento shopsare under attack.

Who this is for

Shops built on Magento, which Adobe also sells as Adobe Commerce. It does not affect WordPress or WooCommerce, Shopify, Wix or Squarespace. If you are not sure what your shop runs on, the free Mendbird check will tell you.

What changed

On 27 October, the US cyber security agency, CISA, added PolyShell (CVE-2026-48356) to its list of known exploited vulnerabilities. That list only holds flaws it has evidence attackers are using. US government departments have until 10 November to fix it.

The flaw itself is not new, which is the worrying part. The security firm Sansec found it and named it in March, and attacks started straight away.

How the attack works

Every Magento shop lets visitors fill a basket without logging in. Some products take a file with the order, such as a picture to print on a mug. PolyShell is a gap in how the basket handles those files:

• Anyone can send a file. The basket accepts one even for a product that never asks for a file, with no login.
• The only check is whether it looks like a picture. Attackers send a file that is a real picture and also a program, which is where the name comes from.
• It is kept where it can be run. The file lands in the shop's public folders. On many shops, asking for it runs the program, and the stranger can then do anything the shop can: read orders, add admin accounts or change the pages customers see.

How widely it is being used

• 17 March. Sansec publishes PolyShell. There is no fix from Adobe yet.
• 24 March. More than half the shops Sansec watches have had a harmful file uploaded.
• 14 April. 82% have.
• 12 May. Adobe releases Magento 2.4.9, which Sansec says closes the gap.
• 14 July. Adobe's security update APSB26-73 brings the fix to older versions.
• 27 October. CISA adds PolyShell to its list of flaws in use.

In one wave, Sansec saw 471 shops broken into within an hour. Being attacked is not the same as being broken into, but a shop without the update has little in its way.

Why a fixed shop should still check

The update closes the gap. It does nothing about a program someone left behind before it was installed, and most shops waited four months for a fix.

Sansec has followed one group using PolyShell and an older flaw, SessionReaper (CVE-2025-54236), to hide its own code inside shop pages. It has found that code on 953 shops since July 2025, and on 83 of them in October alone. Of the Magento shops it looked at that were missing at least one Adobe security update, six in ten had files uploaded through one of the two flaws. One shop that was fully up to date had the code added an hour after a clean scan, because the attackers still had a way in from before.

The code only shows its last step to real shoppers, so a quick look at your own shop will not find it.

What to do now

Is it fixed? Ask whoever looks after the shop for the exact Magento version, and whether Adobe's July 2026 security update (APSB26-73) is installed. Adobe's own bulletin lists every version up to and including 2.4.9 as open until it is. Anything older than 2.4.4 gets no fix from Adobe at all.

Did anyone get in first? The signs a developer can look for:

• files in the pub/media/custom_options folder that are not real pictures
• a file called accesson.php anywhere on the shop
• admin accounts nobody remembers making
• scripts in the shop's content blocks and pages that nobody added

If anything turns up, removing it is not enough. The admin, database and connection passwords need changing too, or the attackers simply come back.

Ask your developer“Has our shop had Adobe’s security updates for PolyShell (APSB26-73) and SessionReaper (APSB25-88)? And have you checked it for uploaded files, admin accounts and scripts that nobody added?”

How Mendbird helps

The free Mendbird check now recognises a Magento shop from the outside. Magento never shows its exact version to visitors, so the report cannot say for certain whether yours is fixed. It names the flaws attackers are using and the question to ask.

The optional Mendbird helper reads the exact version from inside the shop and marks it Dangerous if it is missing either update. On a Watch plan, the Mendbird checks every morning and emails you the day something serious is new.