{"slug":"magento-polyshell","title":"PolyShell (CVE-2026-48356)","shortName":"PolyShell","summary":"Sansec and Akamai describe an unauthenticated unrestricted file upload in Magento Open Source and Adobe Commerce (CVE-2026-48356). Sansec named it PolyShell: a guest-cart REST file option can drop a polyglot in pub/media/custom_options/, which becomes a PHP webshell when the web server executes that directory. Adobe CNA/NVD score 9.3 with user interaction required. CISA KEV added 27 Oct 2026. Sansec reports mass exploitation from March 2026. This page is CVE-2026-48356, not the earlier Magento KEV entry CVE-2026-75650 (CISA KEV dateAdded 8 Sep 2026, catalog 2026.10.27).","isExample":false,"draft":false,"family":"magento-polyshell","kind":"single-product","aliases":["CVE-2026-48356","PolyShell","Magento PolyShell","APSB26-73"],"publishedAt":"2026-10-28","updatedAt":"2026-10-28","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2026-48356","cvss":{"cve":"CVE-2026-48356","score":9.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-48356","sourceDate":"2026-10-27","checkedDate":"2026-10-28"},"epss":{"cve":"CVE-2026-48356","score":0.30582,"percentile":0.98231,"date":"2026-10-27","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2026-48356","checkedDate":"2026-10-28"},"kev":{"cve":"CVE-2026-48356","listed":true,"dateAdded":"2026-10-27","dueDate":"2026-11-10","catalogVersion":"2026.10.27","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-28"},"addedDate":"2026-10-28"},"priority":{"label":"act-now"},"managementSummary":{"what":"Sansec and Akamai describe an unauthenticated file upload in Magento Open Source and Adobe Commerce (CVE-2026-48356, PolyShell). CISA KEV 27 Oct 2026. Sansec reports mass exploitation since March 2026. Adobe CNA/NVD score 9.3 with user interaction required.","action":"Upgrade to the APSB26-73 2026-jul builds. Block web access and PHP execution under pub/media/custom_options/. Hunt uploaded PHP files and accesson.php, then rotate database, admin, and API secrets if you find a hit."},"seenInTheWild":[{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2026-10-27","method":"CISA KEV catalog 2026.10.27, dateAdded 2026-10-27, due 2026-11-10, knownRansomwareCampaignUse Unknown","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"metric":"compromised","value":"471 stores in one hour","observer":"Sansec","date":"2026-03-30","method":"Sansec mass-wave post 30 Mar 2026. None of the compromised stores were Sansec customers.","sourceUrl":"https://sansec.io/research/polyshell-mass-attack-wave"},{"metric":"compromised","value":"56.7% of vulnerable stores","observer":"Sansec via BleepingComputer","date":"2026-03-24","method":"BleepingComputer 25 Mar 2026 quoting Sansec: mass exploitation started 19 Mar; 56.7% of vulnerable stores. Sansec timeline on 17 Mar advisory also lists 56.7% on 24 Mar.","sourceUrl":"https://www.bleepingcomputer.com/news/security/polyshell-attacks-target-56-percent-of-all-vulnerable-magento-stores/"},{"metric":"scanning","value":"79.5% of stores targeted","observer":"Sansec","date":"2026-03-30","method":"Sansec 17 Mar advisory (updated timeline): mass attack wave 30 Mar, 79.5% of all stores targeted. Shield blocked attempts since 16 Mar.","sourceUrl":"https://sansec.io/research/magento-polyshell"},{"metric":"third-party-stated","value":"953 stores since Jul 2025","observer":"Sansec (24 Oct campaign)","date":"2026-10-24","method":"Sansec 24 Oct 2026: deepveindrilling.com campaign hit 953 stores since Jul 2025. Sansec ties the March wave to PolyShell. 102 of 169 Magento 2 installs (60%) also had files uploaded through PolyShell or SessionReaper. Not a count of PolyShell-only breaches.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling"}],"seenInTheWildLinks":[],"whatChanged":{"date":"2026-10-28","items":[{"text":"New catalog page for PolyShell (CVE-2026-48356) in Magento Open Source and Adobe Commerce.","headline":"New catalog page for PolyShell (CVE-2026-48356)","section":"overview","date":"2026-10-28","kind":"page"},{"text":"CISA added CVE-2026-48356 to KEV on 27 Oct 2026 (catalog 2026.10.27, due 10 Nov; ransomware use Unknown).","headline":"CISA added CVE-2026-48356 to KEV (due 10 Nov; ransomware use Unknown)","section":"exploitation","date":"2026-10-27","sourceUrl":"https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog","alsoSourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"},{"text":"Added Am I affected checks, mitigations and response guidance","headline":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected","date":"2026-10-28","kind":"page"}]},"whatTheBugIs":"PolyShell is Sansec's name for an unrestricted file upload (CWE-434) in Magento Open Source and Adobe Commerce, later tracked as CVE-2026-48356. Sansec published the name and the guest-cart REST path on 17 Mar 2026. Adobe published CVE-2026-48356 with bulletin APSB26-73 on 14 Jul 2026.\n\nAdobe's CNA description (NVD, published 14 Jul 2026, last modified 27 Oct 2026) says Adobe Commerce is affected by an unrestricted upload of a file with a dangerous type that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. The CNA text says exploitation requires user interaction: a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. NVD and the Adobe CNA both score CVSS 3.1 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N). Adobe's APSB26-73 HTML bulletin (published 14 Jul 2026, last updated 11 Aug 2026) lists the same CVE as Critical, authentication required No, impact privilege escalation, and a different vector: CVSS 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L).\n\nSansec (17 Mar 2026) and Akamai (27 Mar 2026) describe an unauthenticated upload. Magento's REST API accepts a file_info object on cart item custom options. The guest routes POST /V1/guest-carts/:cartId/items and PUT /V1/guest-carts/:cartId/items/:itemId require no credentials. Sansec says three checks are missing: the option ID is not checked against the product, file upload runs even when the product has no file option, and extensions such as .php, .phtml, and .phar are not blocked. The only gate Sansec names is an image header check (getimagesizefromstring), which a polyglot image can pass. The file is written to pub/media/custom_options/quote/. GraphQL mutations use a different code path and are not vulnerable, per Sansec.\n\nWhether that file becomes remote code execution depends on the web server, not only on the Magento version. Sansec (17 Mar 2026): RCE via PHP upload on stock nginx 2.0.0-2.2.x (via an index.php filename), any version with non-stock nginx passing all .php to fastcgi, and Apache pre-2.3.5 without php_flag engine 0. Stored XSS on all versions pre-2.3.5 or a custom web server config. SL Cyber (26 Mar 2026) reproduced stored XSS after deleting pub/media/custom_options/.htaccess, and RCE after also deleting pub/media/.htaccess (that file contains php_flag engine 0). On Adobe's sample nginx/Apache configs, SL Cyber says the files are inaccessible and not executable.\n\nAdobe APSB26-73 affected lines (CNA and bulletin): Adobe Commerce through 2.4.9 / 2.4.8-p5 / 2.4.7-p10 / 2.4.6-p15 / 2.4.5-p17 / 2.4.4-p18; Magento Open Source through 2.4.9 / 2.4.8-p5 / 2.4.7-p10 / 2.4.6-p15; Adobe Commerce B2B through 1.5.3 / 1.5.2-p5 / 1.4.2-p10 / 1.3.4-p17 / 1.3.3-p18; Adobe Commerce Events 1.6.0 to 1.20.0. Fixed builds are the matching 2026-jul releases, and Events 1.21.0. Sansec (17 Mar 2026) says the vulnerable code has existed since the first Magento 2 release, and that Adobe fixed it in the 2.4.9 pre-release branch as part of APSB25-94. Adobe's APSB25-94 bulletin (14 Oct 2025) lists other CVE IDs and does not name CWE-434 or CVE-2026-48356. Sansec's 12 May 2026 update: Magento 2.4.9 contains the fix, not then backported to 2.4.8, 2.4.7, and earlier. Sansec's later timeline: Adobe backported the fix to supported lines via APSB26-73 on 14 Jul 2026.\n\nThis page does not resolve the Adobe UI:R description against the Sansec/Akamai unauthenticated guest-cart account. Both are public statements. Adobe APSB26-73 (14 Jul, last updated 11 Aug 2026) also said Adobe was not aware of any exploits in the wild for the issues in that bulletin. Sansec had already published in-the-wild use. CISA added the CVE to KEV on 27 Oct 2026.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"Guest cart API","detail":"Sansec (17 Mar 2026) and Akamai (27 Mar 2026): a request with no login reaches Magento REST guest-cart item routes. Adobe CNA/NVD text says user interaction is required."},{"id":"app","label":"File option accepted","detail":"A cart item file option is accepted without checking that the product has that option."},{"id":"exploit","label":"Polyglot passes image check","detail":"A file that looks like an image passes the image header check and keeps a dangerous extension. Conceptual impact class only."},{"id":"exec","label":"File on disk / RCE","detail":"The file lands under pub/media/custom_options/. If the web server executes PHP there, it is a webshell."}]},"exploitation":{"kev":{"listed":true,"date":"2026-10-27","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV catalog 2026.10.27 (released 2026-10-27T19:00:02.2307Z, 1,760 entries). CVE-2026-48356 added 2026-10-27, due 2026-11-10. knownRansomwareCampaignUse Unknown. Notes cite Adobe APSB26-73. Checked 28 Oct 2026."},"firstSeen":{"date":"2026-03-16","source":"Sansec PolyShell advisory (17 Mar 2026, later updated)","note":"Sansec: Shield has blocked PolyShell exploitation attempts since 16 Mar 2026. First probing 16 Mar 2026 at 12:00 UTC; automated mass scanning 19 Mar. Sansec's own timeline table on the same page lists 'First PolyShell attacks observed in the wild' on 19 Mar 2026. Mass wave 30 Mar 2026 (471 stores in one hour). CISA KEV 27 Oct 2026."},"vendorStatements":[{"vendor":"Adobe","date":"14 Jul 2026","statement":"Adobe has released a security update for Adobe Commerce and Magento Open Source. This update resolves critical, important and moderate vulnerabilities. Successful exploitation could lead to arbitrary code execution, privilege escalation, and security feature bypass. Adobe is not aware of any exploits in the wild for any of the issues addressed in these updates. CVE-2026-48356: Unrestricted Upload of File with Dangerous Type (CWE-434), privilege escalation, Critical, authentication required No, CVSS 9.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L. Bulletin last updated 11 Aug 2026.","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","retracted":false},{"vendor":"Adobe (CNA)","date":"14 Jul 2026","statement":"Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed. CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48356","retracted":false},{"vendor":"CISA","date":"27 Oct 2026","statement":"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-48356 Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability. knownRansomwareCampaignUse Unknown. Due 10 Nov 2026.","url":"https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog","retracted":false},{"vendor":"Akamai","date":"27 Mar 2026","statement":"Subsequent research published by Sansec on March 17, 2026, describes how the vulnerabilities in APSB25-94 can be used to achieve unauthenticated remote code execution (RCE). Sansec named this attack PolyShell. This vulnerability does not require authentication. An attacker only needs a Guest Cart ID and a product SKU (both easily obtainable) to execute the upload.","url":"https://www.akamai.com/blog/security-research/magento-polyshell-latest-magento-threat-apsb25-94","retracted":false}]},"timeline":[{"date":"2025-10-14","event":"Adobe published APSB25-94 for Adobe Commerce and Magento Open Source, including 2.4.9-alpha3. Sansec and Akamai later said the PolyShell upload path was fixed in that 2.4.9 pre-release. The bulletin's listed CVEs are not CWE-434 and do not include CVE-2026-48356.","source":{"title":"Security update available for Adobe Commerce | APSB25-94","url":"https://helpx.adobe.com/security/products/magento/apsb25-94.html","publisher":"Adobe"},"kind":"advisory","addedDate":"2026-10-28"},{"date":"2026-03-16","event":"Sansec added PolyShell protection to Shield. Sansec later said first probing started 16 Mar 2026 at 12:00 UTC.","source":{"title":"PolyShell: unrestricted file upload in Magento and Adobe Commerce","url":"https://sansec.io/research/magento-polyshell","publisher":"Sansec"},"kind":"exploited","key":true,"addedDate":"2026-10-28"},{"date":"2026-03-17","event":"Sansec published the public PolyShell warning and named the guest-cart REST upload path. Sansec also added detection patterns to eComscan.","source":{"title":"PolyShell: unrestricted file upload in Magento and Adobe Commerce","url":"https://sansec.io/research/magento-polyshell","publisher":"Sansec"},"kind":"disclosure","key":true,"addedDate":"2026-10-28"},{"date":"2026-03-19","event":"Sansec timeline: first PolyShell attacks observed in the wild; the same advisory also says automated mass scanning kicked in on 19 Mar.","source":{"title":"PolyShell: unrestricted file upload in Magento and Adobe Commerce","url":"https://sansec.io/research/magento-polyshell","publisher":"Sansec"},"kind":"exploited","addedDate":"2026-10-28"},{"date":"2026-03-24","event":"Sansec timeline: 56.7% of all stores have had malicious PHP uploaded. Sansec also linked PolyShell to a WebRTC skimmer on a retailer it valued over $100B.","source":{"title":"PolyShell: unrestricted file upload in Magento and Adobe Commerce","url":"https://sansec.io/research/magento-polyshell","publisher":"Sansec"},"kind":"exploited","addedDate":"2026-10-28"},{"date":"2026-03-25","event":"BleepingComputer reported PolyShell attacks targeting 56% of vulnerable Magento stores, quoting Sansec's 19 Mar mass-exploitation start and 56.7% figure. BleepingComputer said Adobe released a fix in 2.4.9-beta1 on 10 Mar 2026.","source":{"title":"PolyShell attacks target 56% of all vulnerable Magento stores","url":"https://www.bleepingcomputer.com/news/security/polyshell-attacks-target-56-percent-of-all-vulnerable-magento-stores/","publisher":"BleepingComputer"},"kind":"other","addedDate":"2026-10-28"},{"date":"2026-03-26","event":"Searchlight Cyber (SL Cyber) published a lab analysis of the PolyShell upload path and reproduced stored XSS or RCE depending on which .htaccess files were removed.","source":{"title":"Magento PolyShell: Unauthenticated File Upload to RCE (APSB25-94)","url":"https://slcyber.io/research-center/magento-polyshell-unauthenticated-file-upload-to-rce-in-magento-apsb25-94/","publisher":"Searchlight Cyber"},"kind":"poc","addedDate":"2026-10-28"},{"date":"2026-03-27","event":"Akamai deployed Adaptive Security Engine Rapid Rule 3000982 Magento PolyShell (APSB25-94) Attack Detected.","source":{"title":"Magento PolyShell - The Latest Magento Threat (APSB25-94)","url":"https://www.akamai.com/blog/security-research/magento-polyshell-latest-magento-threat-apsb25-94","publisher":"Akamai"},"kind":"vendor","addedDate":"2026-10-28"},{"date":"2026-03-30","event":"Sansec detected 471 stores compromised in one hour and published the lanhd6549tdhse.top loader IOCs. Sansec timeline: 79.5% of stores targeted; accesson.php and JS loaders deployed.","source":{"title":"Mass PolyShell attack wave hits 471 stores in one hour","url":"https://sansec.io/research/polyshell-mass-attack-wave","publisher":"Sansec"},"kind":"exploited","key":true,"addedDate":"2026-10-28"},{"date":"2026-03-31","event":"ProjectDiscovery published the Magento PolyShell Nuclei scanner (magento-polyshell-rce), marked verified, tagged intrusive.","source":{"title":"Magento PolyShell Nuclei scanner","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/magento/magento-polyshell-rce.yaml","publisher":"ProjectDiscovery"},"kind":"poc","addedDate":"2026-10-28"},{"date":"2026-04-14","event":"Sansec timeline: 82% of all stores hit with malicious uploads.","source":{"title":"PolyShell: unrestricted file upload in Magento and Adobe Commerce","url":"https://sansec.io/research/magento-polyshell","publisher":"Sansec"},"kind":"exploited","addedDate":"2026-10-28"},{"date":"2026-05-12","event":"Sansec update: Adobe released Magento 2.4.9 containing the fix. Sansec said the fix had not been backported to 2.4.8, 2.4.7, and earlier.","source":{"title":"PolyShell: unrestricted file upload in Magento and Adobe Commerce","url":"https://sansec.io/research/magento-polyshell","publisher":"Sansec"},"kind":"patch","key":true,"addedDate":"2026-10-28"},{"date":"2026-05-21","event":"CVE-2026-48356 reserved by Adobe (dateReserved 2026-05-21T15:28:38.140Z).","source":{"title":"CVE-2026-48356","url":"https://cveawg.mitre.org/api/cve/CVE-2026-48356","publisher":"CVE Program"},"kind":"disclosure","addedDate":"2026-10-28"},{"date":"2026-07-14","event":"Adobe published APSB26-73 and CVE-2026-48356 (CWE-434). Fixed builds are the 2026-jul releases. NVD published the record at 20:17 UTC. Sansec timeline: Adobe backported the fix to supported lines.","source":{"title":"Security update available for Adobe Commerce | APSB26-73","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","publisher":"Adobe"},"kind":"patch","key":true,"addedDate":"2026-10-28"},{"date":"2026-07-15T13:47:25Z","event":"Public GitHub repository shinthink/magento-polyshell created. We did not run or validate it. Not linked here.","kind":"other","addedDate":"2026-10-28"},{"date":"2026-10-24","event":"Sansec published the deepveindrilling.com CMS-block loader campaign (953 stores since Jul 2025) and tied the March wave to PolyShell (CVE-2026-48356).","source":{"title":"deepveindrilling.com: Magento CMS block loader hits 953 stores","url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","publisher":"Sansec"},"kind":"exploited","addedDate":"2026-10-28"},{"date":"2026-10-27","event":"CISA added CVE-2026-48356 to KEV (catalog 2026.10.27, due 2026-11-10, ransomware use Unknown). NVD lastModified 2026-10-27T20:17:14.683.","source":{"title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","url":"https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog","publisher":"CISA"},"kind":"kev","key":true,"addedDate":"2026-10-28"}],"openNotes":[{"title":"Adobe CNA says user interaction; Sansec and Akamai say unauthenticated guest-cart upload","detail":"Adobe's CNA text and the NVD/OSV 9.3 vector use UI:R and say a victim must visit a crafted URL or interact with a compromised page. CISA ADP Vulnrichment on 27 Oct 2026 set Exploitation active, Automatable no, Technical Impact total. Sansec (17 Mar 2026) and Akamai (27 Mar 2026) say the guest-cart REST file_info upload needs no login, only a guest cart ID and a product SKU. Adobe APSB26-73 lists authentication required No for this CVE. This page records both. It does not pick a winner.","sources":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48356","date":"2026-10-27","publisher":"NVD / Adobe CNA"},{"url":"https://cveawg.mitre.org/api/cve/CVE-2026-48356","date":"2026-10-27","publisher":"CISA ADP / CVE"},{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"},{"url":"https://www.akamai.com/blog/security-research/magento-polyshell-latest-magento-threat-apsb25-94","date":"2026-03-27","publisher":"Akamai"},{"url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","date":"2026-07-14","publisher":"Adobe APSB26-73"}]},{"title":"Adobe bulletin CVSS 9.6 versus CNA/NVD 9.3","detail":"APSB26-73 HTML (published 14 Jul 2026, last updated 11 Aug 2026) lists CVE-2026-48356 as CVSS 9.6 with A:L. The Adobe CNA record, NVD primary metric, and OSV list 9.3 with A:N. This page stores the NVD/CNA 9.3 score.","sources":[{"url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","date":"2026-08-11","publisher":"Adobe"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48356","date":"2026-10-27","publisher":"NVD"}]},{"title":"Adobe APSB26-73 (published 14 Jul, updated 11 Aug 2026): no known in-the-wild use stated","detail":"APSB26-73 (published 14 Jul 2026, last updated 11 Aug 2026) says Adobe is not aware of any exploits in the wild for the issues addressed in these updates. Sansec had published mass exploitation from March. CISA added the CVE to KEV on 27 Oct 2026. The Adobe sentence is kept as a dated vendor statement, not as the current exploitation status.","sources":[{"url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","date":"2026-08-11","publisher":"Adobe"},{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"},{"url":"https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog","date":"2026-10-27","publisher":"CISA"}]},{"title":"APSB25-94 tie is third-party, not an Adobe CWE-434 CVE","detail":"Sansec and Akamai say Adobe fixed the upload path in the 2.4.9 pre-release as part of APSB25-94 (14 Oct 2025). Adobe's APSB25-94 CVE list is CVE-2025-54263 through CVE-2025-54267 and does not include an unrestricted-upload CVE. CVE-2026-48356 was assigned in APSB26-73. BleepingComputer (25 Mar 2026) said Adobe released a fix in 2.4.9-beta1 on 10 Mar 2026; Sansec, Akamai, and SL Cyber name 2.4.9-alpha3.","sources":[{"url":"https://helpx.adobe.com/security/products/magento/apsb25-94.html","date":"2025-10-14","publisher":"Adobe"},{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"},{"url":"https://www.akamai.com/blog/security-research/magento-polyshell-latest-magento-threat-apsb25-94","date":"2026-03-27","publisher":"Akamai"},{"url":"https://www.bleepingcomputer.com/news/security/polyshell-attacks-target-56-percent-of-all-vulnerable-magento-stores/","date":"2026-03-25","publisher":"BleepingComputer"}]},{"title":"Sansec 12 May 2026 says Magento 2.4.9 contains the fix; Adobe lists plain 2.4.9 as affected","detail":"Sansec's 12 May 2026 update says Adobe released Magento 2.4.9 containing the fix, and that the fix had not been backported to 2.4.8, 2.4.7, and earlier. Adobe APSB26-73 (published 14 Jul 2026, last updated 11 Aug 2026) lists Magento Open Source 2.4.9 and Adobe Commerce 2.4.9 as affected, with fixed builds 2.4.9-2026-jul. This page records both. Users on plain 2.4.9 should follow Adobe's fixed-version list and upgrade to 2.4.9-2026-jul.","sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-05-12","publisher":"Sansec"},{"url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","date":"2026-07-14","publisher":"Adobe APSB26-73"}]},{"title":"Sansec 16 Mar probing versus 19 Mar first-attacks timeline row","detail":"The Sansec advisory body says first probing started 16 Mar 2026 at 12:00 UTC and Shield has blocked attempts since that day. The same page's timeline table lists first in-the-wild attacks on 19 Mar 2026. Both dates are Sansec's. This page uses 16 Mar as firstSeen and keeps 19 Mar on the timeline.","sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"}]}],"defenderActions":[{"title":"Patch to an APSB26-73 2026-jul build","detail":"Upgrade Magento Open Source or Adobe Commerce to the July 2026 fixed build for the branch you run: 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, or 2.4.6-2026-jul (Commerce also has 2.4.5-2026-jul and 2.4.4-2026-jul). Apply the matching Adobe Commerce B2B 2026-jul build if you use B2B. Commerce Events: 1.21.0. Users on plain 2.4.9 should follow Adobe APSB26-73, which lists 2.4.9 as affected and 2.4.9-2026-jul as the fix. Sansec's 12 May 2026 note said 2.4.9 contained the fix and had not been backported to older lines; see Open questions.","priority":"now","links":[{"label":"Adobe APSB26-73","href":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"}]},{"title":"Block web access and PHP execution under pub/media/custom_options/","detail":"Sansec 17 Mar 2026: deny all access to pub/media/custom_options/ at the web server, and confirm Apache still has php_flag engine 0 plus Deny from all in that directory's .htaccess. Sansec says this does not stop the API from writing files. It only stops the browser from fetching or running them. Put the nginx location before any .php handler.","priority":"now","links":[{"label":"Sansec PolyShell advisory","href":"https://sansec.io/research/magento-polyshell"}]},{"title":"Hunt uploaded files, accesson.php, and CMS loaders","detail":"Search pub/media/custom_options/ for non-.htaccess files, especially .php, .phtml, and .phar. Search the document root for accesson.php. Sansec also published a cms_block / cms_page search for fpCode, se_referrer, and localStorage.getItem. Treat a hit as compromise, not as a version check.","priority":"now","links":[{"label":"Sansec hunt commands","href":"https://sansec.io/research/magento-polyshell"},{"label":"Sansec 24 Oct loader hunt","href":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling"}]},{"title":"Rotate secrets if you find a hit","detail":"Sansec 24 Oct 2026: after cleanup, change the database, admin, and API integration passwords. Also review admin_user for accounts you do not recognize. A webshell as the web-server user can read app/etc/env.php.","priority":"now","links":[{"label":"Sansec deepveindrilling.com research","href":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling"}]}],"detection":[{"title":"Guest-cart REST item POST or PUT","detail":"Sansec 17 Mar 2026: hunt POST /V1/guest-carts/:cartId/items and PUT /V1/guest-carts/:cartId/items/:itemId. Those routes accept file_info with no login. The route alone fires on all guest add-to-cart traffic. Stronger signals: file_info in the request body where body logging exists, a per-IP volume anomaly, and PHP or unexpected files under pub/media/custom_options/. GraphQL is a different path and is not this upload, per Sansec.","logSource":"Web server or reverse-proxy access logs (nginx/Apache/Magento REST)","kind":"generic","group":"web-proxy","url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17"},{"title":"PHP files under pub/media/custom_options/","detail":"Sansec 17 Mar 2026: any .php, .phtml, or .phar file in pub/media/custom_options/ is a strong compromise indicator. SL Cyber 26 Mar 2026: also treat unexpected non-image files there as leftover uploads that become dangerous if the web server config changes.","logSource":"Magento filesystem (pub/media/custom_options/)","kind":"generic","group":"php-logs","url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17"},{"title":"accesson.php backdoor and 8194460 beacon","detail":"Sansec 17 Mar and 30 Mar 2026: after a successful upload, attackers drop accesson.php under assets/images/ in many top-level directories. A request to a live copy prints 8194460.","logSource":"Magento filesystem and web access logs","kind":"generic","group":"php-logs","url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17"},{"title":"CMS block JavaScript loaders","detail":"Sansec 30 Mar and 24 Oct 2026: hunt cms_block and cms_page content for fpCode, se_referrer, localStorage.getItem, and the published loader domains. A hit means the attacker could write the database, not only that a file was uploaded.","logSource":"Magento database (cms_block.content, cms_page.content)","kind":"generic","group":"php-logs","url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","date":"2026-10-24"},{"title":"Akamai App & API Protector: rule 3000982","detail":"Akamai 27 Mar 2026: Adaptive Security Engine Rapid Rule 3000982 Magento PolyShell (APSB25-94) Attack Detected.","logSource":"Akamai Security Events (WAF) logs","kind":"vendor-signature","group":"waf-ips","url":"https://www.akamai.com/blog/security-research/magento-polyshell-latest-magento-threat-apsb25-94","date":"2026-03-27"}],"detectionRules":[{"id":"v2s-sigma-magento-polyshell-guest-cart","title":"Magento guest-cart REST item write (PolyShell path)","language":"sigma","query":"title: Magento guest-cart REST item write (CVE-2026-48356)\nid: 7c2e1a90-4b6d-4f11-9c3a-0d8e2f4a6b11\nstatus: experimental\ndescription: POST or PUT to Magento REST guest-cart item routes that Sansec named for PolyShell. The route alone fires on all guest add-to-cart traffic, which is normal shop traffic.\nreferences:\n    - https://sansec.io/research/magento-polyshell\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48356\nauthor: vuln2shell\ndate: 2026/10/28\nlogsource:\n    category: webserver\ndetection:\n    selection_method:\n        cs-method:\n            - POST\n            - PUT\n    selection_path:\n        cs-uri-stem|contains|all:\n            - '/V1/guest-carts/'\n            - '/items'\n    condition: selection_method and selection_path\nfalsepositives:\n    - The route alone matches every guest add-to-cart request, not only abuse\n    - Use as a hunting filter. Stronger: file_info in the body where logged, per-IP volume anomaly, or PHP or unexpected files under pub/media/custom_options/\nlevel: low","logSource":"Web server or reverse-proxy access logs (nginx/Apache/Magento REST)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17","license":"CC0 1.0","origin":"vuln2shell","notes":"Hunting rule from Sansec's published guest-cart routes. The guest-cart item route alone fires on all guest add-to-cart traffic, which is normal shop traffic. Stronger signals: file_info in the request body where body logging exists, a per-IP volume anomaly, and PHP or unexpected files under pub/media/custom_options/. Does not include request bodies or payloads. Tune field names to your parser.","tested":"untested"},{"id":"v2s-spl-magento-polyshell-guest-cart","title":"Magento guest-cart REST item write (SPL)","language":"spl","query":"index=web sourcetype=access_combined\n(method=POST OR method=PUT)\nuri_path=\"*/V1/guest-carts/*/items*\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by uri_path, method, host\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web server or reverse-proxy access logs (nginx/Apache/Magento REST)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17","license":"CC0 1.0","origin":"vuln2shell","notes":"The guest-cart item route alone fires on all guest add-to-cart traffic, which is normal shop traffic. Stronger signals: file_info in the request body where body logging exists, a per-IP volume anomaly, and PHP or unexpected files under pub/media/custom_options/. Hunting query from Sansec's published guest-cart routes. Tune sourcetype and field names.","tested":"untested"},{"id":"v2s-kql-magento-polyshell-guest-cart","title":"Magento guest-cart REST item write (KQL)","language":"kql","query":"W3CIISLog\n| where TimeGenerated > ago(14d)\n| where csMethod in (\"POST\",\"PUT\")\n| where csUriStem has \"/V1/guest-carts/\" and csUriStem has \"/items\"\n| summarize count(), min(TimeGenerated), max(TimeGenerated) by Computer, cIP, csUriStem, csMethod\n| order by count_ desc","logSource":"IIS / web access logs shipped to Microsoft Sentinel","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17","license":"CC0 1.0","origin":"vuln2shell","notes":"The guest-cart item route alone fires on all guest add-to-cart traffic, which is normal shop traffic. Stronger signals: file_info in the request body where body logging exists, a per-IP volume anomaly, and PHP or unexpected files under pub/media/custom_options/. Table name varies. Map W3CIISLog to your nginx or Apache parser if those hosts are not IIS.","tested":"untested"},{"id":"v2s-esql-magento-polyshell-guest-cart","title":"Magento guest-cart REST item write (ES|QL)","language":"esql","query":"FROM logs-web.*\n| WHERE @timestamp > NOW() - 14 days\n| WHERE http.request.method IN (\"POST\", \"PUT\")\n| WHERE url.path LIKE \"*\\/V1\\/guest-carts\\/*\" AND url.path LIKE \"*\\/items*\"\n| STATS count = COUNT(*) BY host.name, source.ip, url.path, http.request.method\n| SORT count DESC","logSource":"Web access logs in Elastic","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17","license":"CC0 1.0","origin":"vuln2shell","notes":"The guest-cart item route alone fires on all guest add-to-cart traffic, which is normal shop traffic. Stronger signals: file_info in the request body where body logging exists, a per-IP volume anomaly, and PHP or unexpected files under pub/media/custom_options/. Index and field names vary by integration. Hunting only.","tested":"untested"},{"id":"v2s-suricata-magento-polyshell-guest-cart","title":"Magento guest-cart REST item write (Suricata)","language":"suricata","query":"alert http any any -> any any (msg:\"vuln2shell Magento PolyShell guest-cart item write\"; flow:established,to_server; http.method; content:\"POST\"; http.uri; content:\"/V1/guest-carts/\"; content:\"/items\"; sid:2026483561; rev:1;)","logSource":"Network IDS / Suricata HTTP logs","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17","license":"CC0 1.0","origin":"vuln2shell","notes":"The guest-cart item route alone fires on all guest add-to-cart traffic, which is normal shop traffic. Stronger signals: file_info in the request body where body logging exists, a per-IP volume anomaly, and PHP or unexpected files under pub/media/custom_options/. Covers POST only. Add a twin for PUT if your policy allows. No request body or payload. Local sid; renumber to fit your range. Needs TLS termination or decryption to see the URI.","tested":"untested"},{"id":"v2s-yara-magento-polyshell-accesson","title":"Sansec-published accesson.php markers","language":"yara","query":"rule v2s_magento_polyshell_accesson\n{\n    meta:\n        author = \"vuln2shell\"\n        date = \"2026-10-28\"\n        description = \"Sansec-published accesson.php filename, beacon, and cookie-auth hash markers\"\n        source = \"https://sansec.io/research/magento-polyshell\"\n    strings:\n        $name = \"accesson.php\"\n        $beacon = \"8194460\"\n        $cookie_hash = \"a17028468cb2a870d460676d6d6da3ad63706778e3\"\n        $rce_hash = \"4009d3fa8132195a2dab4dfa3affc8d2\"\n    condition:\n        $name or $beacon or $cookie_hash or $rce_hash\n}","logSource":"Magento filesystem (web root and pub/media/custom_options/)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17","license":"CC0 1.0","origin":"vuln2shell","notes":"Markers only, from Sansec's published hashes and beacon. Does not include webshell source. Expect name collisions on the filename string.","tested":"untested"}],"detectionLinks":[{"title":"ProjectDiscovery Nuclei scanner magento-polyshell-rce","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/magento/magento-polyshell-rce.yaml","author":"slcyber, DhiyaneshDk","date":"2026-03-31","note":"Public scanner, metadata.verified true, tagged intrusive. Names APSB25-94, not CVE-2026-48356. Uploads a file; do not run it against stores you do not own. This site does not copy the request body."},{"title":"Sansec PolyShell advisory detections and hunt commands","url":"https://sansec.io/research/magento-polyshell","author":"Sansec Forensics Team","date":"2026-03-17","note":"Guest-cart routes, upload-directory find, accesson.php find, CMS domain search."},{"title":"Akamai Rapid Rule 3000982","url":"https://www.akamai.com/blog/security-research/magento-polyshell-latest-magento-threat-apsb25-94","author":"Akamai Security Intelligence Group","date":"2026-03-27","note":"WAF rule Magento PolyShell (APSB25-94) Attack Detected."}],"retrohunt":{"summary":"Search web access logs from 16 Mar 2026 for POST or PUT to /V1/guest-carts/.../items. The route alone is normal guest add-to-cart traffic; prefer file_info in the body where logged, a per-IP volume spike, or PHP or unexpected files under pub/media/custom_options/. Also search the document root for accesson.php, and cms_block and cms_page for the Sansec loader markers.","lookback":{"from":"2026-03-16","basis":"first-attempt","rationale":"Sansec says Shield has blocked PolyShell attempts since 16 Mar 2026 and that first probing started that day at 12:00 UTC. Sansec's timeline table lists first in-the-wild attacks on 19 Mar 2026. Hunt from the earlier Sansec date.","sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"},{"url":"https://sansec.io/research/polyshell-mass-attack-wave","date":"2026-03-30","publisher":"Sansec"}]},"logSources":[{"name":"Web server or reverse-proxy access logs","why":"Sansec named POST and PUT /V1/guest-carts/:cartId/items as the unauthenticated upload routes.","required":true},{"name":"Magento filesystem (pub/media/custom_options/ and document root)","why":"Sansec: uploaded polyglots land under custom_options; accesson.php is sprayed into assets/images/ folders.","required":true},{"name":"Magento database cms_block and cms_page","why":"Sansec 30 Mar and 24 Oct: JS loaders were written into CMS content.","required":true},{"name":"Akamai Security Events (WAF) logs","why":"Akamai rule 3000982 if you run App & API Protector.","required":false}],"steps":[{"title":"Search access logs for guest-cart item writes from 16 Mar 2026","detail":"Hunt POST and PUT requests whose URI contains /V1/guest-carts/ and /items. Sansec named those routes. The route alone fires on all guest add-to-cart traffic. Prefer file_info in the body where logged, a per-IP volume anomaly, or on-disk PHP or unexpected files under pub/media/custom_options/. Keep client IP, timestamp, and status.","sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"}]},{"title":"List files in pub/media/custom_options/","detail":"Sansec: find pub/media/custom_options/ -type f ! -name '.htaccess'. Any .php, .phtml, or .phar file is a strong hit.","sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"}]},{"title":"Search the document root for accesson.php","detail":"Sansec: find /var/www -name 'accesson.php' -type f. Also check the published assets/images/ paths.","sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"}]},{"title":"Search CMS content for loader markers","detail":"Sansec 24 Oct: SELECT block_id, identifier, update_time FROM cms_block WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%' OR content LIKE '%localStorage.getItem%'; run the same on cms_page. Add your table prefix if you use one.","sources":[{"url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","date":"2026-10-24","publisher":"Sansec"}]}],"queries":[{"id":"v2s-rh-spl-magento-polyshell-guest-cart","title":"Guest-cart item writes since 16 Mar 2026 (SPL)","language":"spl","query":"index=web sourcetype=access_combined earliest=03/16/2026:00:00:00\n(method=POST OR method=PUT)\nuri_path=\"*/V1/guest-carts/*/items*\"\n| stats count min(_time) as firstTime max(_time) as lastTime values(clientip) as src by uri_path, method, host, status\n| convert ctime(firstTime) ctime(lastTime)","logSource":"Web server or reverse-proxy access logs (nginx/Apache/Magento REST)","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17","license":"CC0 1.0","origin":"vuln2shell","notes":"The guest-cart item route alone fires on all guest add-to-cart traffic, which is normal shop traffic. Stronger signals: file_info in the request body where body logging exists, a per-IP volume anomaly, and PHP or unexpected files under pub/media/custom_options/. Lookback from Sansec's 16 Mar 2026 first-probing date. Tune sourcetype.","tested":"untested","timeRange":"From 16 Mar 2026"},{"id":"v2s-rh-kql-magento-polyshell-guest-cart","title":"Guest-cart item writes since 16 Mar 2026 (KQL)","language":"kql","query":"W3CIISLog\n| where TimeGenerated >= datetime(2026-03-16)\n| where csMethod in (\"POST\",\"PUT\")\n| where csUriStem has \"/V1/guest-carts/\" and csUriStem has \"/items\"\n| summarize count(), min(TimeGenerated), max(TimeGenerated) by Computer, cIP, csUriStem, scStatus\n| order by count_ desc","logSource":"IIS / web access logs shipped to Microsoft Sentinel","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17","license":"CC0 1.0","origin":"vuln2shell","notes":"The guest-cart item route alone fires on all guest add-to-cart traffic, which is normal shop traffic. Stronger signals: file_info in the request body where body logging exists, a per-IP volume anomaly, and PHP or unexpected files under pub/media/custom_options/. Map the table to nginx or Apache if those hosts are not IIS.","tested":"untested","timeRange":"From 16 Mar 2026"}],"thirdPartyQueries":[{"title":"ProjectDiscovery Nuclei scanner magento-polyshell-rce","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/magento/magento-polyshell-rce.yaml","author":"slcyber, DhiyaneshDk","date":"2026-03-31","language":"guide","license":"MIT","origin":"community","note":"Intrusive scanner. Do not run it against stores you do not own. Linked, not copied."}],"artefacts":[{"kind":"file","value":"pub/media/custom_options/quote/","detail":"Sansec and SL Cyber: destination for the guest-cart file_info upload.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"kind":"file","value":"accesson.php","detail":"Sansec: secondary backdoor. A live copy prints 8194460.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"kind":"web-log","value":"POST or PUT /V1/guest-carts/:cartId/items","detail":"Sansec: unauthenticated upload routes.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"kind":"report","value":"cms_block.content loader script","detail":"Sansec 24 Oct 2026: loader lives in cms_block, not in core_config_data or theme files, in the installs eComscan checked.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"},{"kind":"report","value":"a17028468cb2a870d460676d6d6da3ad63706778e3","detail":"Sansec 17 Mar 2026: cookie-authenticated GIF89a webshell verifies cookie d against this 42-character hex string. Not a file MD5.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"kind":"report","value":"4009d3fa8132195a2dab4dfa3affc8d2","detail":"Sansec 17 Mar 2026: password-protected RCE shell uses hash_equals with this hardcoded value. Sansec: double-MD5 of the password. Not a file MD5.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"kind":"report","value":"localStorage 136c1e07507f4a97","detail":"Sansec 30 Mar 2026: localStorage key used by the March JS loader. Browser storage, not an HTTP header.","sourceUrl":"https://sansec.io/research/polyshell-mass-attack-wave","sourceDate":"2026-03-30"},{"kind":"report","value":"localStorage fpCode","detail":"Sansec 24 Oct 2026: localStorage key used by the October loader. Browser storage, not an HTTP header.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"},{"kind":"report","value":"localStorage 136c1e07507f4a98","detail":"Sansec 24 Oct 2026: additional localStorage key listed in the campaign IOC table. Browser storage, not an HTTP header.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"}],"iocs":[{"type":"ip","value":"3.12.250[.]83","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"3.88.149[.]41","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"3.150.234[.]247","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"18.220.50[.]153","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"23.22.254[.]35","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"31.134.0[.]53","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"31.134.1[.]34","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"31.134.7[.]117","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"31.134.11[.]173","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"31.134.15[.]89","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"31.134.15[.]251","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"45.136.24[.]213","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"45.136.26[.]181","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"45.136.27[.]218","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"45.147.233[.]211","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"45.147.234[.]73","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"45.155.166[.]228","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"52.24.6[.]119","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"64.49.38[.]96","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"78.129.161[.]63","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"79.130.2[.]23","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"81.169.144[.]135","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"91.132.124[.]183","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"103.216.223[.]206","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"109.107.178[.]102","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"115.79.194[.]68","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"136.244.92[.]114","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"140.235.2[.]103","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"140.235.171[.]72","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"140.248.75[.]31","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"140.248.75[.]114","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"162.159.113[.]66","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"185.3.235[.]111","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"193.151.188[.]86","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"193.233.216[.]217","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"193.233.221[.]124","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"194.180.233[.]186","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"198.186.130[.]10","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"199.96.165[.]186","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"212.87.218[.]43","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"216.38.6[.]137","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"ip","value":"2001:19f0:6c01:15da:5400:6ff:fe05[:]e560","context":"Sansec 17 Mar 2026: source IP observed in PolyShell scanning (50+). Defanged as published.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"index.php","context":"Sansec 17 Mar 2026: most common upload name; attackers often prepend the option ID (for example 780index.php).","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"json-shell.php","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"bypass.phtml","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"c.php","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"r.php","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"rce.php","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"static.php","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"test.php","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"blocked-json.php","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"bypass-async.php","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"urlencode-shell.php","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"xx_malicious_file.php","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"ato_poc.html","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"mikhail.html","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"toggige-arrow.jpg","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"adman.429.txt","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"adman.309.txt","context":"Sansec 17 Mar 2026: filename observed in PolyShell attacks.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"var/assets/images/accesson.php","context":"Sansec 17 Mar 2026: accesson.php planted on a single compromised store.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"bamboo-specs/assets/images/accesson.php","context":"Sansec 17 Mar 2026: accesson.php planted on a single compromised store.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"lib/assets/images/accesson.php","context":"Sansec 17 Mar 2026: accesson.php planted on a single compromised store.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"app/assets/images/accesson.php","context":"Sansec 17 Mar 2026: accesson.php planted on a single compromised store.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"vendor/assets/images/accesson.php","context":"Sansec 17 Mar 2026: accesson.php planted on a single compromised store.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"pub/assets/images/accesson.php","context":"Sansec 17 Mar 2026: accesson.php planted on a single compromised store.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"bin/assets/images/accesson.php","context":"Sansec 17 Mar 2026: accesson.php planted on a single compromised store.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"setup/assets/images/accesson.php","context":"Sansec 17 Mar 2026: accesson.php planted on a single compromised store.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"generated/assets/images/accesson.php","context":"Sansec 17 Mar 2026: accesson.php planted on a single compromised store.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"phpserver/assets/images/accesson.php","context":"Sansec 17 Mar 2026: accesson.php planted on a single compromised store.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"pub/media/custom_options/","context":"Sansec 17 Mar 2026: guest-cart file option upload directory. Files land under quote/.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"path","value":"pub/media/custom_options/quote/","context":"Sansec 17 Mar 2026 and SL Cyber 26 Mar 2026: written file path after a guest-cart file_info upload.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"filename","value":"accesson.php","context":"Sansec 17 Mar and 30 Mar 2026: secondary backdoor sprayed across writable directories. Beacon prints 8194460.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"domain","value":"lanhd6549tdhse.top","context":"Sansec 30 Mar 2026: loader domain registered 25 Mar 2026; first seen on stores 30 Mar 2026.","sourceUrl":"https://sansec.io/research/polyshell-mass-attack-wave","sourceDate":"2026-03-30"},{"type":"url","value":"https://lanhd6549tdhse.top/KZtBscgb","context":"Sansec 30 Mar 2026: loader URL. Base64 in the injected script decodes to https://lanhd6549tdhse.top/KZtBscgb?&se_referrer=.","sourceUrl":"https://sansec.io/research/polyshell-mass-attack-wave","sourceDate":"2026-03-30"},{"type":"domain","value":"jslibrary[.]net","context":"Sansec 17 Mar 2026: search CMS content for this domain (defanged as published).","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"domain","value":"canevaslab[.]com","context":"Sansec 17 Mar 2026: search CMS content for this domain (defanged as published).","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"type":"domain","value":"deepveindrilling.com","context":"Sansec 24 Oct 2026: newest loader domain of the campaign Sansec reported in March as the PolyShell mass attack. Registered 6 Oct 2026; first stores 7 Oct 2026. Not every hit is a fresh PolyShell upload.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"},{"type":"url","value":"https://deepveindrilling.com/?s=d35c5031","context":"Sansec 24 Oct 2026: loader URL seen from 7 Oct 2026.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"},{"type":"url","value":"https://deepveindrilling.com/?s=49b7ca5f&fp=","context":"Sansec 24 Oct 2026: fingerprinting loader URL from the 23 Oct rewrite.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"},{"type":"url","value":"https://additionalver.com/Mb2z8J","context":"Sansec 24 Oct 2026: Keitaro URL. Domain registered 7 Jun 2026; first seen on stores 8 Jun 2026.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"},{"type":"url","value":"https://neswnsssn.click/PKgJDPfF","context":"Sansec 24 Oct 2026: Keitaro URL. First seen on stores 12 Dec 2025.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"},{"type":"url","value":"https://manulfie.click/GKTD8cBz","context":"Sansec 24 Oct 2026: Keitaro URL. First seen on stores 9 Jul 2025.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"},{"type":"url","value":"https://hdfdsi84j3h.top/sFnnPFHm","context":"Sansec 24 Oct 2026: Keitaro URL. Registered three minutes after lanhd6549tdhse.top.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"},{"type":"url","value":"https://c85grt98sd.com/1kYrdH","context":"Sansec 24 Oct 2026: Keitaro URL seen on a few stores.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"},{"type":"url","value":"https://leqdger.click/ssl/","context":"Sansec 24 Oct 2026: payload URL. Domain registered 12 Sep 2025; later expired.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"},{"type":"url","value":"https://crypto-insider.top/ssl/","context":"Sansec 24 Oct 2026: payload URL served via manulfie.click on 12 Dec 2025.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"}],"iocNote":"IOCs below are copied from Sansec pages only, with the date of that page. Sansec's two in-shell hashes and three localStorage keys stay in prose and artefacts; they are not typed as file hashes or HTTP headers and are omitted from STIX. Akamai published a WAF rule ID, not network IOCs. Defanging matches the source where Sansec defanged the value.","hitMeaning":[{"level":"attempt","detail":"The guest-cart item route alone is normal shop traffic, not an attempt. Treat as an attempt when the request body contains file_info (where body logging exists), the same IP shows a volume anomaly, or Akamai 3000982 fires. Sansec: blocking the directory does not stop the write."},{"level":"likely-compromise","detail":"A .php, .phtml, or .phar file under pub/media/custom_options/, or CMS content that contains a Sansec loader marker."},{"level":"confirmed-compromise","detail":"accesson.php on disk, a live 8194460 beacon, or a webshell under custom_options that the web server executes."}],"nextSteps":[{"title":"Contain the storefront and admin, then keep the files","detail":"Take the host off the open internet or block /pub/media/custom_options/ and /media/custom_options/ at the edge. Preserve the uploaded files and CMS rows before cleanup.","priority":"now"},{"title":"Patch, remove leftovers, rotate secrets","detail":"Apply APSB26-73, delete unexpected files under custom_options, remove accesson.php copies, clean CMS content, then rotate database, admin, and API passwords (Sansec 24 Oct 2026).","priority":"now"}],"limits":["Sansec says a successful upload can be quiet if PHP execution is off; files still remain on disk.","The 24 Oct loader campaign also used other access paths, including SessionReaper (CVE-2025-54236). A loader hit is not proof of this CVE alone.","Sansec, as of 14 Jul 2026 (latest dated timeline row on that advisory): Cloudflare has not published a WAF rule covering PolyShell (CVE-2026-48356). We did not re-verify Cloudflare after 28 Oct 2026."],"sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"},{"url":"https://sansec.io/research/polyshell-mass-attack-wave","date":"2026-03-30","publisher":"Sansec"},{"url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","date":"2026-10-24","publisher":"Sansec"}],"updatedAt":"2026-10-28"},"amIAffected":{"summary":"Magento Open Source through 2.4.9 / 2.4.8-p5 / 2.4.7-p10 / 2.4.6-p15 and Adobe Commerce through those lines plus 2.4.5-p17 and 2.4.4-p18, before the matching 2026-jul build. Adobe Commerce B2B and Events have their own APSB26-73 ranges. Sansec: the upload path has existed since the first Magento 2 release. RCE still depends on whether the web server executes files under pub/media/custom_options/.","checks":[{"id":"v2s-aia-magento-polyshell-version-1","kind":"version","title":"bin/magento --version","detail":"Adobe Commerce CLI reference: bin/magento --version (-V) displays this application version. Compare the printed version to the APSB26-73 affected and fixed lists.","command":"php bin/magento --version","affectedMeans":"Magento Open Source 2.4.9, 2.4.8-p5 or earlier, 2.4.7-p10 or earlier, or 2.4.6-p15 or earlier, or Adobe Commerce on those lines plus 2.4.5-p17 or earlier or 2.4.4-p18 or earlier, and the version is not a 2026-jul build.","fixedMeans":"Version is 2.4.9-2026-jul, 2.4.8-2026-jul, 2.4.7-2026-jul, 2.4.6-2026-jul, or (Commerce only) 2.4.5-2026-jul or 2.4.4-2026-jul, or a later build on that branch.","notes":"Run from the Magento root as the file-system owner. This is inventory only.","sources":[{"url":"https://experienceleague.adobe.com/en/docs/commerce-operations/tools/cli-reference/commerce-on-premises","date":null,"publisher":"Adobe Commerce docs"},{"url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","date":"2026-07-14","publisher":"Adobe"}]},{"id":"v2s-aia-magento-polyshell-package-2","kind":"package","title":"Composer metapackage name and version","detail":"Adobe's Composer install doc names magento/project-community-edition (Magento Open Source) and magento/project-enterprise-edition (Adobe Commerce), including security-patch names such as 2.4.6-p1. Read the installed metapackage version; do not invent a lockfile field.","command":"composer show magento/project-community-edition magento/project-enterprise-edition 2>/dev/null; composer show magento/product-community-edition magento/product-enterprise-edition 2>/dev/null","affectedMeans":"The installed Commerce or Open Source metapackage is in an APSB26-73 affected range and is not a 2026-jul build.","fixedMeans":"The installed metapackage is a 2026-jul build or later on that branch.","notes":"Adobe's install examples use project-* metapackages. Some hosts pin product-* packages instead. Compare whatever composer show prints to APSB26-73. Auth to repo.magento.com may be required.","sources":[{"url":"https://experienceleague.adobe.com/en/docs/commerce-operations/installation-guide/composer","date":null,"publisher":"Adobe Commerce docs"},{"url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","date":"2026-07-14","publisher":"Adobe"}]},{"id":"v2s-aia-magento-polyshell-config-3","kind":"config","title":"Upload directory not web-executable","detail":"Sansec and SL Cyber: RCE needs the web server to serve or execute files under pub/media/custom_options/. Check that the directory is denied and that PHP is off. This does not replace the APSB26-73 patch. Sansec: files can still be written.","command":"ls -la pub/media/custom_options/.htaccess pub/media/.htaccess 2>/dev/null; grep -nE 'php_flag engine|Deny from all|Require all denied' pub/media/custom_options/.htaccess pub/media/.htaccess 2>/dev/null; grep -nE 'custom_options|location' nginx.conf app/etc/nginx.conf 2>/dev/null","affectedMeans":"The directory is readable or PHP is enabled there, or the .htaccess files Sansec/SL Cyber named are missing, or nginx has no deny for /pub/media/custom_options/ before the PHP handler.","fixedMeans":"Web access is denied and PHP engine is off under pub/media/custom_options/, and the Magento version is a 2026-jul build. Config-only hardening is not the vendor fix.","notes":"SL Cyber 26 Mar 2026: they reproduced XSS after removing pub/media/custom_options/.htaccess and RCE after also removing pub/media/.htaccess. Adobe AccessFileName changes can ignore .htaccess if the file is not renamed.","sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"},{"url":"https://slcyber.io/research-center/magento-polyshell-unauthenticated-file-upload-to-rce-in-magento-apsb25-94/","date":"2026-03-26","publisher":"Searchlight Cyber"}]},{"id":"v2s-aia-magento-polyshell-exposure-4","kind":"exposure","title":"Shodan Magento_PageCache in your ranges only","detail":"ProjectDiscovery's Nuclei scanner metadata lists shodan-query html:\"Magento_PageCache\". That is a Magento fingerprint, not a PolyShell-fixed-version check. Scope it to your estate.","command":"shodan search 'html:\"Magento_PageCache\" net:<your-range>'","affectedMeans":"A host in your range serves Magento_PageCache. You still need bin/magento --version on that host.","fixedMeans":"No Magento_PageCache hosts in your range, or every such host is on a 2026-jul build.","notes":"Not a vulnerable-version query. Do not scan third-party stores.","sources":[{"url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/magento/magento-polyshell-rce.yaml","date":"2026-03-31","publisher":"ProjectDiscovery"}]}],"limits":["bin/magento --version does not tell you whether PHP runs under pub/media/custom_options/.","The Shodan string is a Magento fingerprint from the Nuclei scanner metadata, not an Adobe or Sansec vulnerable-build query.","No sourced Censys query. Do not invent one.","Adobe Commerce Events 1.6.0 to 1.20.0 is in the CNA affected list; bin/magento --version may not print that module."],"sources":[{"url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","date":"2026-07-14","publisher":"Adobe"},{"url":"https://experienceleague.adobe.com/en/docs/commerce-operations/tools/cli-reference/commerce-on-premises","date":null,"publisher":"Adobe Commerce docs"},{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"}],"updatedAt":"2026-10-28","addedDate":"2026-10-28"},"mitigations":{"summary":"Adobe APSB26-73 names the 2026-jul upgrades as the fix and does not publish a workaround. Until you can patch, Sansec (17 Mar 2026) documented denying web access to pub/media/custom_options/. That does not stop the API from writing files.","items":[{"title":"Deny web access to pub/media/custom_options/ (nginx)","detail":"Sansec 17 Mar 2026: add a location that denies /pub/media/custom_options/ inside the server block, before any .php location. Otherwise the PHP handler takes precedence and uploaded shells stay executable.","limits":"Does not prevent uploads. Attackers can still write files through the API. Not an Adobe workaround. Replace this with the APSB26-73 upgrade.","verify":"A browser request to a file under /pub/media/custom_options/ or /media/custom_options/ returns 403 or 404. Confirm after the next nginx reload.","source":{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"}},{"title":"Confirm Apache .htaccess denies the upload directory and turns PHP off","detail":"Sansec 17 Mar 2026: pub/media/custom_options/.htaccess should exist and contain php_flag engine 0 plus Deny from all. If AccessFileName is not .htaccess, rename the file to match.","limits":"SL Cyber reproduced RCE after both this file and pub/media/.htaccess were removed. Missing files, or a host that ignores .htaccess, leave the directory executable. Does not prevent uploads.","verify":"The .htaccess file is present, readable by Apache, and a direct request for a file in that directory is denied. Re-check after a vhost change.","source":{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"}}],"updatedAt":"2026-10-28","addedDate":"2026-10-28"},"response":{"summary":"If you find a PHP file under pub/media/custom_options/ or accesson.php anywhere on the host, treat the store as compromised. Preserve those files and CMS rows, contain the upload directory, patch to APSB26-73, then rotate database, admin, and API secrets.","containment":[{"title":"Block the upload directory and take an internet-facing store off the open internet if you see a webshell","detail":"Sansec: deny pub/media/custom_options/ at the web server. If you already have a live accesson.php or an executable upload, contain at the edge before you rotate secrets.","sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"}]},{"title":"Upgrade to an APSB26-73 build, then keep hunting leftovers","detail":"Adobe: 2026-jul builds. Sansec 24 Oct: patched stores can still get the CMS loader through other access. A version bump does not remove uploaded files or injected blocks.","sources":[{"url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","date":"2026-07-14","publisher":"Adobe"},{"url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","date":"2026-10-24","publisher":"Sansec"}]}],"rotate":[{"item":"Database, admin, and API integration passwords","reason":"Sansec 24 Oct 2026: after cleanup, change the database, admin, and API integration passwords.","sources":[{"url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","date":"2026-10-24","publisher":"Sansec"}]},{"item":"Admin accounts you do not recognize, plus secrets in app/etc/env.php","reason":"Sansec 24 Oct 2026: check admin_user for accounts you do not recognize. General: a webshell as the web-server user can read env.php. No Adobe list of extra key names.","generic":true,"sources":[{"url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","date":"2026-10-24","publisher":"Sansec"}]}],"persistence":[{"kind":"path","value":"pub/media/custom_options/quote/","detail":"Sansec 17 Mar 2026: guest-cart file_info writes here. Sansec 24 Oct: one 2.4.7-p1 store had PolyShell webshells disguised as PNG images in this directory.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"kind":"webshell","value":"accesson.php","detail":"Sansec 17 Mar 2026: secondary backdoor sprayed under assets/images/ in many top-level folders. Beacon 8194460.","sourceUrl":"https://sansec.io/research/magento-polyshell","sourceDate":"2026-03-17"},{"kind":"path","value":"cms_block.content / cms_page.content","detail":"Sansec 30 Mar and 24 Oct 2026: obfuscated JavaScript loaders written into CMS blocks and pages.","sourceUrl":"https://sansec.io/research/polyshell-mass-attack-wave","sourceDate":"2026-03-30"}],"observedBehaviour":[{"title":"Two-stage JavaScript loader with localStorage persistence","detail":"Sansec 30 Mar 2026: after the webshell, attackers injected a loader that replays a payload from localStorage key 136c1e07507f4a97 and fetches https://lanhd6549tdhse.top/KZtBscgb. Sansec 17 Mar 2026 also published two in-shell hashes used as cookie or password checks (42-character hex a17028468cb2a870d460676d6d6da3ad63706778e3, and 4009d3fa8132195a2dab4dfa3affc8d2, which Sansec calls a double-MD5 of the password). Those are not file MD5 hashes.","sourceUrl":"https://sansec.io/research/polyshell-mass-attack-wave","sourceDate":"2026-03-30"},{"title":"WebRTC payment-card skimmer on some attacks","detail":"BleepingComputer 25 Mar 2026, citing Sansec: some attacks suspected to exploit PolyShell delivered a WebRTC skimmer that uses DTLS-encrypted UDP and a forged SDP exchange. Sansec said it was seen on a car-maker site valued over $100B.","sourceUrl":"https://www.bleepingcomputer.com/news/security/polyshell-attacks-target-56-percent-of-all-vulnerable-magento-stores/","sourceDate":"2026-03-25"},{"title":"deepveindrilling.com fingerprinting loader (Oct 2026)","detail":"Sansec 24 Oct 2026: the same campaign moved to deepveindrilling.com. Sansec listed localStorage keys fpCode and 136c1e07507f4a98. Those are browser storage keys, not HTTP headers. Sansec has not captured the final payload. 60 of 83 stores on the new domain were already old victims.","sourceUrl":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","sourceDate":"2026-10-24"}],"evidence":[{"title":"Uploaded files under pub/media/custom_options/ from 16 Mar 2026","detail":"Preserve the files, names, timestamps, and owners before deletion. Sansec: any .php, .phtml, or .phar file there is a strong indicator.","sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"}]},{"title":"Guest-cart REST access logs from 16 Mar 2026","detail":"Keep POST and PUT lines for /V1/guest-carts/.../items, including client IP and status.","sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"}]},{"title":"CMS block and page rows that contain loader markers","detail":"Preserve block_id, identifier, update_time, and content for rows matching fpCode, se_referrer, or localStorage.getItem (Sansec 24 Oct 2026).","sources":[{"url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","date":"2026-10-24","publisher":"Sansec"}]}],"limits":["Sansec's 24 Oct loader campaign also used SessionReaper and rogue admin accounts. A CMS loader is not proof of this CVE alone.","Adobe has not published persistence paths for CVE-2026-48356. Paths on this page come from Sansec."],"sources":[{"url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","publisher":"Sansec"},{"url":"https://sansec.io/research/polyshell-mass-attack-wave","date":"2026-03-30","publisher":"Sansec"},{"url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","date":"2026-10-24","publisher":"Sansec"},{"url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","date":"2026-07-14","publisher":"Adobe"}],"updatedAt":"2026-10-28","addedDate":"2026-10-28"},"bulletins":[{"vendor":"Adobe","title":"Security update available for Adobe Commerce | APSB26-73","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","date":"2026-07-14","cve":"CVE-2026-48356"},{"vendor":"CISA","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","url":"https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog","date":"2026-10-27","cve":"CVE-2026-48356"}],"coverage":[{"title":"Security update available for Adobe Commerce | APSB26-73","publisher":"Adobe","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html","date":"2026-07-14","type":"vendor","addedDate":"2026-10-28"},{"title":"Security update available for Adobe Commerce | APSB25-94","publisher":"Adobe","url":"https://helpx.adobe.com/security/products/magento/apsb25-94.html","date":"2025-10-14","type":"vendor","addedDate":"2026-10-28"},{"title":"NVD - CVE-2026-48356","publisher":"NVD","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48356","date":"2026-07-14","type":"government","addedDate":"2026-10-28"},{"title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog","publisher":"CISA","url":"https://www.cisa.gov/news-events/alerts/2026/10/27/cisa-adds-two-known-exploited-vulnerabilities-catalog","date":"2026-10-27","type":"government","addedDate":"2026-10-28"},{"title":"PolyShell: unrestricted file upload in Magento and Adobe Commerce","publisher":"Sansec","url":"https://sansec.io/research/magento-polyshell","date":"2026-03-17","type":"research","addedDate":"2026-10-28"},{"title":"Mass PolyShell attack wave hits 471 stores in one hour","publisher":"Sansec","url":"https://sansec.io/research/polyshell-mass-attack-wave","date":"2026-03-30","type":"research","addedDate":"2026-10-28"},{"title":"deepveindrilling.com: Magento CMS block loader hits 953 stores","publisher":"Sansec","url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","date":"2026-10-24","type":"research","addedDate":"2026-10-28"},{"title":"Magento PolyShell - The Latest Magento Threat (APSB25-94)","publisher":"Akamai","url":"https://www.akamai.com/blog/security-research/magento-polyshell-latest-magento-threat-apsb25-94","date":"2026-03-27","type":"research","addedDate":"2026-10-28"},{"title":"Magento PolyShell: Unauthenticated File Upload to RCE (APSB25-94)","publisher":"Searchlight Cyber","url":"https://slcyber.io/research-center/magento-polyshell-unauthenticated-file-upload-to-rce-in-magento-apsb25-94/","date":"2026-03-26","type":"research","addedDate":"2026-10-28"},{"title":"PolyShell attacks target 56% of all vulnerable Magento stores","publisher":"BleepingComputer","url":"https://www.bleepingcomputer.com/news/security/polyshell-attacks-target-56-percent-of-all-vulnerable-magento-stores/","date":"2026-03-25","type":"news","addedDate":"2026-10-28"},{"title":"OSV CVE-2026-48356","publisher":"OSV","url":"https://osv.dev/vulnerability/CVE-2026-48356","date":"2026-07-14","type":"vendor","addedDate":"2026-10-28"}],"posts":[],"research":[{"title":"PolyShell: unrestricted file upload in Magento and Adobe Commerce","url":"https://sansec.io/research/magento-polyshell","authors":"Sansec Forensics Team","date":"17 Mar 2026"},{"title":"Mass PolyShell attack wave hits 471 stores in one hour","url":"https://sansec.io/research/polyshell-mass-attack-wave","authors":"Sansec Forensics Team","date":"30 Mar 2026"},{"title":"deepveindrilling.com: Magento CMS block loader hits 953 stores","url":"https://sansec.io/research/magento-cms-block-loader-deepveindrilling","authors":"Sansec Forensics Team","date":"24 Oct 2026"},{"title":"Magento PolyShell - The Latest Magento Threat (APSB25-94)","url":"https://www.akamai.com/blog/security-research/magento-polyshell-latest-magento-threat-apsb25-94","authors":"Akamai Security Intelligence Group","date":"27 Mar 2026"},{"title":"Magento PolyShell: Unauthenticated File Upload to RCE (APSB25-94)","url":"https://slcyber.io/research-center/magento-polyshell-unauthenticated-file-upload-to-rce-in-magento-apsb25-94/","authors":"Searchlight Cyber","date":"26 Mar 2026"},{"title":"CISA KEV catalog JSON (CVE-2026-48356 listed; catalog 2026.10.27)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","authors":"CISA","date":"catalog 2026.10.27, checked 28 Oct 2026"}],"impact":{"kind":"single-product","product":"Magento Open Source / Adobe Commerce","versions":[{"version":"Magento Open Source 2.4.9","status":"affected","versions":"2.4.9-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Magento Open Source 2.4.8-p5 and earlier","status":"affected","versions":"2.4.8-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Magento Open Source 2.4.7-p10 and earlier","status":"affected","versions":"2.4.7-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Magento Open Source 2.4.6-p15 and earlier","status":"affected","versions":"2.4.6-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce 2.4.9","status":"affected","versions":"2.4.9-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce 2.4.8-p5 and earlier","status":"affected","versions":"2.4.8-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce 2.4.7-p10 and earlier","status":"affected","versions":"2.4.7-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce 2.4.6-p15 and earlier","status":"affected","versions":"2.4.6-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce 2.4.5-p17 and earlier","status":"affected","versions":"2.4.5-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce 2.4.4-p18 and earlier","status":"affected","versions":"2.4.4-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce B2B 1.5.3","status":"affected","versions":"1.5.3-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce B2B 1.5.2-p5 and earlier","status":"affected","versions":"1.5.2-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce B2B 1.4.2-p10 and earlier","status":"affected","versions":"1.4.2-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce B2B 1.3.4-p17 and earlier","status":"affected","versions":"1.3.4-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce B2B 1.3.3-p18 and earlier","status":"affected","versions":"1.3.3-2026-jul","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Adobe Commerce Events 1.6.0 to 1.20.0","status":"affected","versions":"1.21.0","vendorStatement":{"date":"14 Jul 2026","url":"https://helpx.adobe.com/security/products/magento/apsb26-73.html"},"addedDate":"2026-10-28"},{"version":"Magento 2.0 through 2.3","status":"affected","vendorStatement":{"date":"17 Mar 2026","url":"https://sansec.io/research/magento-polyshell","quote":"The vulnerable code has existed since the very first Magento 2 release."},"addedDate":"2026-10-28"}]},"pocs":[{"title":"Searchlight Cyber lab write-up of the PolyShell upload path","url":"https://slcyber.io/research-center/magento-polyshell-unauthenticated-file-upload-to-rce-in-magento-apsb25-94/","source":"Searchlight Cyber","validationStatus":"validated","validationDate":"2026-03-26","notes":"Searchlight Cyber (26 Mar 2026) says it reproduced stored XSS after deleting pub/media/custom_options/.htaccess and RCE after also deleting pub/media/.htaccess. That is Searchlight Cyber's claim, not a vuln2shell validation. Names APSB25-94 / PolyShell, not CVE-2026-48356. Listed for defenders. This site does not republish exploit code or request bodies.","addedDate":"2026-10-28"},{"title":"ProjectDiscovery Nuclei scanner magento-polyshell-rce","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/magento/magento-polyshell-rce.yaml","source":"slcyber, DhiyaneshDk / ProjectDiscovery","validationStatus":"validated","validationDate":"2026-03-31","notes":"ProjectDiscovery marked metadata.verified true on the 31 Mar 2026 Nuclei scanner commit. That is ProjectDiscovery's claim, not a vuln2shell validation. Intrusive: it uploads a file. Names APSB25-94, not CVE-2026-48356. Do not run it against stores you do not own. This site does not copy the request body.","addedDate":"2026-10-28"}],"pocEmptyState":"Public scanners and write-ups exist for the PolyShell guest-cart upload path. Searchlight Cyber (26 Mar 2026) and the ProjectDiscovery Nuclei scanner (31 Mar 2026) state lab or verified status; those are their claims. This site does not republish exploit code.","_feed":{"page":"https://vuln2shell.com/vulns/magento-polyshell","json":"https://vuln2shell.com/vulns/magento-polyshell.json","iocsCsv":"https://vuln2shell.com/vulns/magento-polyshell/iocs.csv","stix":"https://vuln2shell.com/vulns/magento-polyshell/stix.json","badges":{"patch":"Patched","itw":"Exploited in the wild","poc":"Public PoC: RCE"}}}