Barsec Cyber Intel
Magento & Adobe Commerce Stores Targeted in PolyShell Attacks: What Owners Should Do
Security firm Sansec reports widespread attacks on a Magento and Adobe Commerce file upload flaw it calls PolyShell (CVE-2026-48356). Adobe released fixes for supported versions in July 2026. Here is how to make sure your store is covered.
What happened
PolyShell is a flaw in Magento Open Source and Adobe Commerce, the software behind many online stores. It lets someone upload a harmful file to a store without logging in, by disguising code as an ordinary image. Security firm Sansec discovered and named it, and it is tracked as CVE-2026-48356. Sansec reports that attackers began probing stores in March 2026 and that its protection service has blocked attack attempts against 79.5% of the Magento stores it protects. Adobe's own bulletin, APSB26-73, rates the flaw Critical but says Adobe is not aware of exploits in the wild. The attack reports come from Sansec, not Adobe. The fix arrived in stages. It first appeared in a 2.4.9 pre-release, then in the full Magento 2.4.9 release in May 2026. On July 14, 2026, Adobe released fixes for its other supported versions as well.
Why this matters
Your store handles customer details, orders and payments. According to Sansec, attackers used this flaw to plant hidden backdoors and inject code into store pages, which can let them return later or interfere with checkout. Even if your server blocks the uploaded file from running today, it can stay on disk and become dangerous after a server change. Updating closes the door, and checking for leftovers makes sure nobody is already inside.
What you should do
- Find out which version of Magento or Adobe Commerce your store runs. Your web developer or hosting provider can tell you quickly.
- Ask them to install the July 2026 security update for your version. The fixed releases end in "-2026-jul", for example 2.4.8-2026-jul or 2.4.7-2026-jul.
- If your store runs a version older than the ones Adobe still supports, ask about upgrading. Older versions may not receive this fix.
- Ask them to check the server for unexpected files, especially in the upload folder for product options, and for unfamiliar files named accesson.php anywhere on the site.
- Review your store admin, pages and content blocks for changes, users or scripts nobody on your team added.
- If you are not sure who manages your store or whether it has been checked, send Barsec a message and we can help.