MAG212 CYBER ORIGINAL ARTICLE

PolyShell (CVE-2026-48356): Why Patched Magento Stores Still Run a Hidden JavaScript Loader

October 28, 2026 · EL MOSTAFA OUCHEN

MAG212 CYBER | Cyber Incidents | October 28, 2026

Patching a hacked Magento store does not remove the attacker. That is the lesson of a campaign Sansec has tracked across 953 stores since July 2025: a JavaScript loader hidden in the database, not the filesystem, that survives updates and clean scans. Its biggest boost came from PolyShell (CVE-2026-48356), an unauthenticated file-upload flaw in Magento and Adobe Commerce that attackers have mass-exploited since March 2026 and that was reportedly added to CISA’s KEV catalog on 27 October.

Key facts

ItemDetail
CVECVE-2026-48356, nicknamed “PolyShell”
ProductAdobe Commerce and Magento Open Source (REST API guest-cart custom options)
WeaknessCWE-434 unrestricted upload of file with dangerous type
SeverityCVSS 3.1 9.6 (Adobe bulletin, AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L); 9.3 in the CVE record after a 21 July rescore
AuthenticationNone
Fixed inAdobe APSB26-73 (14 July 2026; updated 11 August)
ExploitationMass exploitation since 19 March 2026 (Sansec)
CISA KEVReported added 27 October 2026; not independently confirmed at press time
Loader campaign953 stores since July 2025; newest domain on 83 stores

What PolyShell is

PolyShell abuses the custom-options feature of guest carts in Magento’s REST API. Attackers upload polyglot files that are both valid images and valid PHP, which land in pub/media/custom_options/quote/ and act as web shells. Adobe first fixed it only in the 2.4.9 pre-release line (APSB25-94) and back-ported the fix to supported versions in APSB26-73 on 14 July.

Sansec’s timeline shows how fast it spread: disclosure on 17 March, first attacks on 19 March, malicious PHP on 56.7% of vulnerable stores by 24 March, and a mass wave on 30 March. Adobe’s bulletin still says it is “not aware of any exploits in the wild”, wording that predates or ignores that activity.

The loader that outlives the patch

Sansec’s 24 October report links one operator to five loader domains since July 2025:

Magento loader domains by number of infected stores, from Sansec research
Stores loading each domain. Counts overlap across domains. Source: Sansec, 24 October 2026.

The newest domain, deepveindrilling.com, registered on 6 October, sits in the CMS blocks of 83 stores, 60 of which already ran an earlier loader. During the 30 March PolyShell wave, the operator put a loader on 471 stores in one hour.

What makes it hard to find:

  • It lives only in the cms_block table. Sansec never found it in theme files or core_config_data, so file-integrity scans miss it.
  • It persists in the browser. The loader stores code under the fpCode key in the visitor’s localStorage and replays it through an onclick handler, so it runs even if the domain goes offline.
  • It hides from scanners. Since 23 October it fingerprints browsers itself (checking navigator.webdriver, Selenium globals and ChromeDriver cdc_ properties) and gives automated visitors a clean page. An urlscan.io visit saw nothing.
  • Old domains became new risks. Two expired loader domains were re-registered in May 2026 behind a parking service and were still loading on a handful of stores, so their visitors’ data now reaches a new owner.

Sansec has not captured the final payload. One earlier chain loaded scripts from a domain imitating the Ledger crypto-wallet brand.

The patched-store case: on 23 October, a store running 2.4.7-p10 with no missing core patches received the loader one hour after a clean scan. Sansec had found a rogue admin account there on 16 September and a GSocket backdoor on 24 September. Patch state and eradication state are different facts.

Indicators of compromise

TypeIndicator
Loader domainsdeepveindrilling[.]com, additionalver[.]com, lanhd6549tdhse[.]top, manulfie[.]click, neswnsssn[.]click
Minor domainshdfdsi84j3h[.]top, c85grt98sd[.]com
Payload domainsleqdger[.]click, crypto-insider[.]top
localStorage keysfpCode, 136c1e07507f4a97, 136c1e07507f4a98
Decoy responseQWE=123;
Web shellsaccesson.php, 780index.php, bypass.phtml, c.php, rce.php, json-shell.php

How to check your Magento store

1. Search the database. Run on a read-only replica and adjust the table prefix. The update_time column marks the attacker’s last write.

SELECT block_id, identifier, update_time
FROM   cms_block            -- repeat for cms_page
WHERE  content LIKE '%fpCode%'
   OR  content LIKE '%se_referrer%'
   OR  content LIKE '%localStorage.getItem%'
   OR  content LIKE '%deepveindrilling%'
   OR  content LIKE '%additionalver%';

Matches are leads: legitimate JavaScript can use localStorage, and obfuscation can defeat string searches.

2. Sweep upload directories for PolyShell files.

find pub/media/custom_options/ -type f ! -name '.htaccess'
find pub/media/customer_address/ -type f
find . -name 'accesson.php' -type f

Any .php, .phtml or .phar file in an upload directory is a strong indicator of compromise.

3. Review admin users and processes.

SELECT user_id, username, email, created, logdate
FROM admin_user ORDER BY created DESC;

Look for unknown accounts and unfamiliar long-running processes, such as GSocket (gs-netcat).

How to patch: APSB26-73 versions

APSB26-73 affects Adobe Commerce 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17, 2.4.4-p18 and earlier, Magento Open Source 2.4.6-p15 through 2.4.9, plus B2B and Commerce Events. Fixed builds use date-based names such as 2.4.8-2026-jul. Sansec also recommends APSB25-88 for SessionReaper (CVE-2025-54236): 60% of loader stores missing a core patch also had PolyShell or SessionReaper uploads.

Clean-up checklist

  1. Remove the injected scripts and restore CMS blocks and pages from trusted content.
  2. Close the entry point: patch, then delete web shells and rogue admin accounts.
  3. Rotate database, admin, API and integration credentials after containment.
  4. Deploy a Content Security Policy with reporting, and alert on new script origins.
  5. Monitor cms_block.update_time for unexpected writes.
  6. Test from a real browser profile in an isolated environment. Automated scanners may be served a clean page.

Frequently asked questions

What is PolyShell?

PolyShell is the nickname for CVE-2026-48356, an unauthenticated file-upload vulnerability in Magento and Adobe Commerce that lets attackers plant PHP web shells disguised as images.

Does patching remove the PolyShell malware?

No. The patch closes the entry point, but web shells, rogue admin accounts and loaders injected into the database remain until you remove them.

Why don’t security scanners detect the loader?

It lives in the database rather than in files, and since 23 October 2026 it detects automated browsers and serves them a clean page.

What score does CVE-2026-48356 have?

Adobe’s bulletin lists CVSS 9.6; the CVE record was rescored to 9.3 on 21 July 2026 after the availability impact was removed.

Sources

This article expands the Magento feature from the MAG212 CYBER October 28, 2026 Intelligence Edition. Check suspicious script domains with our free link checker.

Read the full magazine (PDF) →