PolyShell just hit CISA KEV, and your Magento guest cart is still an upload folder

remember that deepveindrilling.com CMS block loader we covered a few days ago? the front door for a big chunk of those infections was an unauthenticated file upload Adobe quietly patched in July. CISA put CVE-2026-48356 on KEV on October 27. the sloth would like a word with every store still on 2.4.8-p5.

what the KEV entry actually says

• CVE-2026-48356, “Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability.” CVSS 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L). Adobe says no authentication required. CISA: known ransomware use unknown. forensic triage: no.
• affected: Adobe Commerce 2.4.9, 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, 2.4.5-p17 and earlier, 2.4.4-p18 and earlier; Magento Open Source matching lines; B2B 1.5.3 / 1.5.2-p5 and earlier; Events 1.6.0 to 1.20.0.
• fixed: the July 2026 isolated patches (2.4.9-2026-jul and siblings), B2B 1.5.3-2026-jul lines, Events 1.21.0.

Adobe’s advisory still says “not aware of exploits in the wild” as of the July publish. Sansec, VulnCheck, and now CISA disagree with that timeline. trust the KEV.

how PolyShell works, in sloth speed

1. no login required. Magento’s guest cart REST endpoints POST /V1/guest-carts/:cartId/items and the matching PUT accept a custom_options entry with base64 file_info.
2. almost no validation. before APSB26-73, CustomOptionProcessor did not check that the submitted option_id existed, did not check that the product even had a file-type option, and did not run NotProtectedExtension. it mostly checked getimagesizefromstring().
3. polyglot lands on disk. a GIF89a or PNG header plus a .php / .phtml / .phar filename drops into pub/media/custom_options/quote/. whether it executes depends on the web server. many Magento hosts still do.
4. follow-on persistence. operators spray a cookie-authenticated backdoor named accesson.php across top-level directories, then inject CMS block loaders. Sansec’s October wave used deepveindrilling.com with WebGL/WebDriver fingerprinting so scanners see nothing and shoppers get the payload.

that is why “we patched the store” and “the loader is gone” are different sentences. deleting the script does not remove the rogue admin, the GSocket, or the webshell under vendor/assets/images/.

what to do before November 10

1. install APSB26-73 for your release line. if you are off support, upgrade first, then patch. Events module to 1.21.0.
2. hunt before you celebrate. look for anything other than .htaccess under pub/media/custom_options/, and for accesson.php under var/, app/, vendor/, pub/, lib/, bin/, setup/, generated/.
3. grep the database. search cms_block and cms_page for fpCode, localStorage.getItem, and loader domains including deepveindrilling.com and the older Sansec-tracked hosts.
4. audit admin_user for accounts you did not create. Sansec has seen patched stores get the loader via a leftover rogue admin weeks after the core patches landed.
5. interim controls while you patch: deny PHP execution under pub/media/custom_options/, and if your WAF can, block anonymous guest-cart item POSTs that carry file_info. neither replaces the patch.
6. rotate database, admin, and API integration credentials after cleanup.

sloth take

Adobe shipped the fix in mid-July. attackers shipped the mass wave in March and never really stopped. CISA’s October 27 KEV entry is the federal stamp saying the window is closed. if your guest cart can still accept a polyglot named like an image, you are not “behind on patching.” you are hosting someone else’s loader farm. the sloth suggests today, not November 10.

if your edge stack or storefront still has a KEV item open, get a second set of eyes before the federal deadline. Book a slot with Dark Edge Consulting.

sources

• CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog” (October 27, 2026) and KEV entry for CVE-2026-48356
• Adobe, APSB26-73 Security update available for Adobe Commerce (July 14, 2026)
• Sansec research on PolyShell exploitation and the deepveindrilling.com CMS block campaign (2026)
• Cybersecsloth, “953 Magento Stores Got a CMS Block Loader Named deepveindrilling.com”