Decision needed this week

CVE-2026-48356, nicknamed PolyShell, lets anyone on the internet upload a file to a Magento or Adobe Commerce store through its public shopping-cart API, with no login. On many servers that file becomes a backdoor that criminals use to plant card skimmers. Attacks have been running since March 2026, and on 27 October CISA added it to its list of actively exploited flaws, with a 10 November deadline for US federal agencies. If your store has not installed Adobe’s July 2026 security update (APSB26-73), treat it as urgent, and check for signs of compromise even if you have.

9.3 - CVSS 3.1 score, rated critical by Adobe and NIST

0 - accounts or passwords the attacker needs

471 - stores infected in one hour on 30 March 2026 (Sansec)

10 Nov - CISA deadline to patch or stop using the product

Most security bulletins can wait for the next maintenance window. This one should not.…