If you run a store on Magento or Adobe Commerce, stop what you’re doing and check your version number. Adobe shipped an emergency-grade patch on July 14, 2026 that fixes a file upload flaw attackers had already been exploiting for months, on stores with no login required. If you haven’t applied it, your store is sitting exposed right now.
What actually happened
In March 2026, the e-commerce security firm Sansec disclosed a vulnerability it nicknamed PolyShell, a flaw in Magento’s REST API that let anyone, without an account or password, upload a file disguised as a product image and have the server run it as code. Sansec said the bug existed in every version of Magento 2 ever shipped, and that the exploit worked by crafting a “polyglot” file that passed as both a valid image and a working PHP script (Sansec, March 2026).
Adobe had a fix ready, but only in the unreleased 2.4.9 pre-release branch. Every store running a production version, 2.4.8 and earlier, was left without an official patch for months. Security reporter Ravie Lakshmanan covered the gap for The Hacker News, noting Adobe’s own guidance leaned on a sample server configuration that most hosting providers don’t actually use out of the box (The Hacker News, March 20, 2026).
Attackers didn’t wait around. Sansec tracked active exploitation starting March 16, automated mass scanning three days later, and by March 30 documented a single wave that compromised 471 stores in one hour, all traced to a domain registered four days earlier (Sansec, March 30, 2026). Separately, the threat intelligence firm Netcraft flagged a defacement campaign that hit roughly 15,000 hostnames across 7,500 domains starting in late February, touching infrastructure tied to brands including Asus, FedEx, and Toyota, though Netcraft researcher Harry Everett told The Hacker News it wasn’t clear that campaign used the same flaw.
The patch that finally closes the gap
On July 14, 2026, Adobe released security bulletin APSB26-73, a Priority 2 update covering Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and Adobe Commerce Events. It patches every supported line, 2.4.4 through 2.4.9, and resolves 13 vulnerabilities in total, 8 of them rated critical. The headline fix is CVE-2026-48356 (CVSS 9.6), the unrestricted file upload flaw at the heart of PolyShell, alongside CVE-2026-48358, an unauthenticated, zero-interaction webhooks flaw that NVD scored a maximum 10.0. Adobe says it isn’t aware of active exploitation of the specific issues in this bulletin, but given PolyShell’s track record, that’s not a reason to wait.
What to do this week
If you or your developer manage a Magento or Adobe Commerce store, treat this as a today task, not a someday task:
Apply the APSB26-73 patch to your version line, even if a full platform upgrade isn’t feasible right now. Adobe built it as an isolated patch specifically so stores don’t have to do a full migration to get covered. Next, check your web server configuration directly. Confirm that nginx or Apache actually blocks PHP execution inside pub/media/custom_options/, since Sansec found that most stores run custom hosting configurations that don’t match Adobe’s sample setup. Then run a malware scan of the full installation, not just the upload directory, because a quietly planted backdoor can sit dormant for weeks. Finally, if you can’t patch immediately, put a web application firewall in front of the store. Sansec’s own researchers pointed out that blocking access to the upload folder doesn’t stop the upload itself, only a WAF that inspects API payloads catches that.
If you’re not on Magento, don’t get comfortable
It’s tempting to read this as a Magento problem and move on. It isn’t. This is the same pattern that has hit e-commerce platforms repeatedly: a critical bug, a slow patch cycle, and thousands of stores exposed in the gap. We covered the broader version of this risk in our rundown of the security threats targeting small stores in 2026, and the fundamentals haven’t changed. Whatever platform you run, the same three habits matter: patch on a schedule instead of waiting for a headline, know which of your extensions and plugins touch file uploads or payment data, and keep a working backup you’ve actually tested.
If your store runs on WooCommerce instead, the platform is different but the exposure isn’t smaller. Plugin vulnerabilities are the most common entry point on WordPress-based stores, which is part of why hosting choice matters more than most merchants assume. Our comparison of WooCommerce hosting for growing stores looks at which hosts bake in the kind of malware scanning and hardened configuration that would have caught a PolyShell-style upload before it did damage.
It’s also worth remembering that file-upload flaws aren’t the only door attackers are trying. Automated bots probing your checkout for weaknesses, including the card-testing bots we broke down in this look at stopping checkout fraud, run on the same logic as PolyShell’s scanning wave: cheap automation, tried against thousands of stores at once, banking on the fact that most won’t have patched or configured things correctly. If you haven’t run through a full audit recently, our e-commerce security checklist for small stores is a reasonable place to start, patch status included.
The takeaway
PolyShell wasn’t exotic. It was an old-fashioned unrestricted file upload bug, the kind of thing security checklists have warned about for twenty years, sitting in a platform that powers a meaningful slice of global e-commerce. The lesson isn’t really about Magento. It’s that patch cycles are a business risk, not just an IT chore. Adobe’s July 14 update closes the specific hole. Whether your store closes it depends on whether someone actually applies it this week instead of next quarter.
Sources
- Sansec, “PolyShell: unrestricted file upload in Magento and Adobe Commerce,” March 2026. sansec.io/research/magento-polyshell
- Sansec, “Mass PolyShell attack wave hits 471 stores in one hour,” March 30, 2026. sansec.io/research/polyshell-mass-attack-wave
- Ravie Lakshmanan, “Magento PolyShell Flaw Enables Unauthenticated Uploads, RCE and Account Takeover,” The Hacker News, March 20, 2026. thehackernews.com
- Adobe, Security Bulletin APSB26-73, July 14, 2026. helpx.adobe.com/security/products/magento/apsb26-73.html
Last reviewed: July 23, 2026
Affiliate disclosure: This site may earn commissions from links in this article, at no extra cost to you.
