Magento Loader Changes Expose Retained Access
Sansec’s 24 October report counts 953 stores since July 2025, mainly Magento. Of 83 loading a newer address, 60 already carried older loaders. These are overlapping historical counts.
Sansec describes one reportedly core-patched store receiving rewritten database content on 23 October after rogue-account and backdoor findings. Deleting the loader leaves that access intact. Researchers have not recovered the final visitor-specific payload; its eventual effect remains unconfirmed. BlackTree has not verified that deployment.
The related upload flaw, PolyShell (CVE-2026-48356), entered CISA’s exploitation catalogue on 27 October. Its vulnerability record requires user interaction. Its 10 November catalogue deadline concerns covered federal agencies; apply the directive’s exposure-specific duties rather than treating it as a universal cutoff. Ransomware use is unknown; the forensic-triage flag is No. Neither field establishes that a store is clean.
Adobe’s July bulletin lists 2.4.6-2026-jul, 2.4.7-2026-jul, 2.4.8-2026-jul and 2.4.9-2026-jul for Magento Open Source; its Commerce list additionally includes 2.4.4-2026-jul and 2.4.5-2026-jul. Follow the product’s installation instructions. These are that bulletin’s correction packages, not a newest-release claim. Its no-known-exploitation statement, updated 11 August, predates the current listing.
Investigate retained access
Earlier upload exploits do not establish every victim’s entry route.
Review database blocks and pages, unexpected accounts, uploaded files and unfamiliar processes. Establish and close the access path, then rotate database, administrator and integration credentials following remediation.
