CISA added the Adobe Commerce and Magento flaw to its exploited-vulnerabilities catalogue on October 27. US federal civilian executive agencies must apply fixes by November 10.
The US Cybersecurity and Infrastructure Security Agency (CISA) added a flaw affecting Adobe Commerce and Magento to its Known Exploited Vulnerabilities catalogue on October 27, 2026, citing evidence that attackers are using it. The flaw, CVE-2026-48356, also called PolyShell, can let attackers run code with the current user’s permissions.
The listing follows Sansec’s finding that attackers exploited PolyShell to breach hundreds of e-commerce stores, as The Hacker News said in its October 28 report. The attackers inserted a malicious loader—a program that fetches and runs more software—through a Magento content management system block, a section of store content managed within Magento.
PolyShell allows unrestricted uploads of dangerous file types. Running attacker-supplied code with the current user’s permissions could give an attacker greater access or control over a victim’s account or session. The vulnerability has a reported Common Vulnerability Scoring System severity score of 9.3 out of 10.
The loader is designed to fetch and execute an attacker-controlled payload, meaning the software delivered in the next stage of the attack. No next-stage malware had been recovered as of October 28, leaving both that payload and the campaign’s exact objectives unknown.
The November 10, 2026, deadline requires US Federal Civilian Executive Branch agencies to apply the necessary fixes; it is not a deadline imposed on every store operator.
The W27 keeps the Galaxy Z Fold 8 Ultra’s core hardware, with dark-red or dark-blue finishes, golden accents and 16GB of working memory in both storage versions.
2 min
The satellite operator expects access to more than twice OneWeb’s current bandwidth in return for spending in 2027–2034, with initial IRIS² services expected from 2030.
3 min
The black, gold and green edition follows September’s sold-out preorders. Nintendo’s replenished launch-day stock also quickly sold out.
1 min
