If your online shop runs on Magento or Adobe Commerce, this is the week to check your patches.
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue, based on evidence of active exploitation. One of them is CVE-2026-48356, an “unrestricted upload of file with dangerous type” flaw in Adobe Commerce and Magento, known as PolyShell. The other is CVE-2026-111497, an unchecked return value bug in Google’s Brotli compression library.
CISA’s rules only bind US federal agencies, but the agency encourages every organisation to prioritise fixing KEV-listed bugs.
The campaign behind it
The timing lines up with new research from e-commerce security firm Sansec, reported by SecurityWeek and The Hacker News. Sansec says an unknown threat actor has infected 953 online stores, most of them running Magento, in a campaign active since July 2025.
The attackers inject a small JavaScript loader into the store’s CMS blocks, the content pieces Magento uses to render things like headers, footers and banners. When a shopper visits, their browser asks the attacker’s server what to do next. The server checks whether the visitor is a real shopper or a security scanner, and scanners get nothing, which makes the infection harder to spot.
Sansec estimates that 471 Magento stores were injected with the loader through PolyShell in March, and found more than 100 stores with files uploaded through PolyShell or an older flaw called SessionReaper (CVE-2025-54236). The final payload hasn’t been captured yet, but earlier versions served scripts from crypto-themed domains, including one imitating the Ledger wallet brand.
Patching alone isn’t enough
Here’s the worrying part. Sansec found one store on Magento 2.4.7-p10, with no missing core patches, that still got the latest loader. A rogue admin account and a backdoor had been found on it weeks earlier. In other words, a store that was compromised before patching can stay compromised after.
Adobe fixed PolyShell in its APSB26-73 update for supported release lines. Researchers advise store owners to check for unexpected content in the cms_block and cms_page database tables, look for rogue admin accounts, change all passwords and keep installations on the latest patches.
Why it matters
Online stores are prime targets because they handle payments and customer data. If you run Magento or Adobe Commerce, confirm APSB26-73 is applied, then audit admin users and CMS blocks rather than assuming you’re safe. If you run WordPress or another platform, the lesson still applies: patch quickly, remove unused admin accounts and use a scanner or monitoring service that watches what visitors’ browsers actually load.
Sources: CISA, SecurityWeek, The Hacker News, Adobe. Written by the xRapid Media LLP team.