Patch todayAdobe Commerce / MagentoWebsites & online stores

Hackers have broken into hundreds of online stores through a Magento upload flaw

Who's affected: Online stores built on Adobe Commerce or Magento.
Under attack?: Yes. Security firm Sansec says attackers have been planting a hidden loader in store content blocks since at least July 2025.
What to do: Install Adobe's security patch for this flaw, then check your store's CMS blocks for code you didn't add.
Fixed in: See Adobe's security bulletin
CISA deadline: Federal agencies must fix this by Nov 10, 2026. Everyone else should treat that as a ceiling, not a target.

CVE-2026-48356Severity score 9.3/10Chance of attack in 30 days: 59% (EPSS)Listed Oct 27, 2026Source: The Hacker News ↗

Adobe scorecard: every exploited Adobe flaw →

Client notice ready to send

Fill in the bracketed parts, then paste into an email to your clients or team.

Subject: Security update: Adobe Commerce / Magento

Hi [Client name],

Attackers are actively exploiting a security flaw in Adobe Commerce / Magento.

Who's affected: Online stores built on Adobe Commerce or Magento.

What we're doing: [We're checking your systems now and will have the fix in place by DATE.]

What to do: Install Adobe's security patch for this flaw, then check your store's CMS blocks for code you didn't add.

Fixed in: See Adobe's security bulletin
Reference: CVE-2026-48356 – https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html

We'll confirm once everything is updated. Reply here with any questions.

[Your name]

Hackers have broken into hundreds of online stores through a Magento upload flaw

Also under attack in Websites & online stores