PolyShell Hits CISA KEV: 953 Magento Stores, One Loader, and a Patch From July

CISA added CVE-2026-48356, better known as PolyShell, to its Known Exploited Vulnerabilities catalog on October 27. It's an unrestricted file upload bug in Adobe Commerce and Magento Open Source, CVSS 9.3. Adobe fixed it back in July in APSB26-73. So this isn't a new bug. It's an old bug that a lot of stores still haven't patched, and somebody has been cashing in on that.

What Sansec Found

Sansec published research on October 24 tying a long-running campaign to Magento file upload flaws. The numbers:

• 953 stores infected since July 2025, across five loader domains. The newest, deepveindrilling[.]com, was registered October 6 and is already on 83 stores.
• 471 stores in about an hour. In March, the operator used PolyShell to upload webshells and then injected the loader into 471 stores within roughly 60 minutes. That's not a person clicking around. That's a pipeline.
• 60% of unpatched installs were hit. Of 169 Magento 2 installs in the campaign missing core patches, 102 also had files uploaded through PolyShell or SessionReaper (CVE-2025-54236).

Why It's Hard to Spot

The loader doesn't live in theme files or core_config_data, where most people look. It lives in the cms_block table in the database.

And it actively hides from scanners. The October 23 version fingerprints the browser and checks for automation markers like navigator.webdriver, Selenium globals, and ChromeDriver properties. Automated scanners got nothing. Real shoppers got whatever the operator decided to serve. An earlier version stashed the payload in the visitor's localStorage, so it could run again on later visits even if the domain went down.

Sansec hasn't captured the final payload yet, so the end goal isn't confirmed. Earlier payloads pointed to crypto-themed domains, including a misspelled Ledger wallet lookalike. Draw your own conclusions about what a crypto-wallet lure on a checkout site is for.

One more detail I didn't love: two old loader domains expired and got re-registered by someone new in May. Sansec still found them on 15 stores this fall, quietly sending visitor data to whoever owns them now. Cleanup that stops at "the domain is dead" isn't cleanup.

Patched Doesn't Mean Clean

Sansec saw a store on 2.4.7-p10 get the loader after a clean scan. If an attacker got in before you patched, the patch closes the door behind them. It doesn't walk them out.

What To Do

• Patch. Install APSB26-73 (PolyShell) and APSB25-88 (SessionReaper) for your release line. Federal agencies have until November 10, but nobody running a store should wait that long.
• Search the database, not just the files. Check cms_block and cms_page for fpCode, se_referrer, and localStorage.getItem, and look at update_time for recent changes you didn't make.
• Hunt for webshells. Look in pub/media/custom_options/ and pub/media/customer_address/ for unexpected files, search for accesson.php, and review admin_user for accounts nobody recognizes.
• Rotate credentials. Removing the script doesn't remove the attacker's database access. Change database, admin, and API integration passwords.
• Don't trust a single clean scan. This loader was built to fool scanners. Inspect what real browsers receive and watch outbound connections from checkout pages.

Bottom Line

PolyShell is a reminder that "patch available" and "patched" are different states, and attackers live in the gap. If you run Magento and haven't installed the July fix, assume you need to look for someone already inside, not just close the door.

Sources: Sansec research, The Hacker News, Security Affairs on the KEV addition, and SecurityOnline