CISA added CVE-2026-48356 — an unrestricted file-upload flaw (CVSS 9.3) in Adobe Commerce and Magento that leads to arbitrary code execution — to its Known Exploited Vulnerabilities catalogue on 27 October, citing active exploitation, days after Sansec observed attackers using the flaw, dubbed PolyShell, to breach hundreds of e-commerce stores by injecting a malicious loader via a Magento CMS block. The loader fetches and executes an attacker-controlled payload, though no next-stage malware has been recovered, and activity is assessed as ongoing since at least July 2025. The same KEV batch added Google Brotli's CVE-2026-111497 (the Node2Shell decoder flaw, covered below). Magento merchants — including the Australian stores still running unpatched installations after this week's web-skimming reporting — should treat the KEV listing as a hard upgrade deadline; the platform's patch cadence has become the campaign surface of choice for storefront criminal activity.

• Source article