# E-commerce Security

Published articles for E-commerce Security.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges

DevFeed: [Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges](<https://devfeed.tech/articles/adobe-commerce-polyshell-attacks-breach-hundreds-of-stores-as-brotli-exploit-traffic-emerges-104123.md>)

Original publisher: [Read original article](<https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html>)

Author: The Hacker News

Published: 2026-10-28T05:42:26Z

Content type: news

Language: en

Sources: [Cyber Newsroom](<https://devfeed.tech/sources/cyber-newsroom.md>)

Topics: [Cybersecurity](<https://devfeed.tech/topics/cybersecurity.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [adobe](<https://devfeed.tech/tags/adobe.md>), [attacks](<https://devfeed.tech/tags/attacks.md>), [breach](<https://devfeed.tech/tags/breach.md>), [brotli](<https://devfeed.tech/tags/brotli.md>), [brotli-decoder](<https://devfeed.tech/tags/brotli-decoder.md>), [cisa](<https://devfeed.tech/tags/cisa.md>), [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [commerce](<https://devfeed.tech/tags/commerce.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-111497](<https://devfeed.tech/tags/cve-2026-111497.md>), [cyber-attack](<https://devfeed.tech/tags/cyber-attack.md>), [cybersecurity](<https://devfeed.tech/tags/cybersecurity.md>), [cybersecurity-and-infrastructure-security-agency](<https://devfeed.tech/tags/cybersecurity-and-infrastructure-security-agency.md>), [e-commerce-security](<https://devfeed.tech/tags/e-commerce-security.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [exploited](<https://devfeed.tech/tags/exploited.md>), [google](<https://devfeed.tech/tags/google.md>), [library](<https://devfeed.tech/tags/library.md>), [magento](<https://devfeed.tech/tags/magento.md>), [security](<https://devfeed.tech/tags/security.md>), [software-security](<https://devfeed.tech/tags/software-security.md>), [traffic](<https://devfeed.tech/tags/traffic.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [web-security](<https://devfeed.tech/tags/web-security.md>)

### AI overview

CISA added Google Brotli CVE-2026-111497 and Adobe Commerce/Magento CVE-2026-48356 (PolyShell) to its KEV catalog based on active exploitation. Sansec reported PolyShell used to breach hundreds of stores and inject a loader through a Magento CMS block; its next-stage payload has not been recovered. Brotli exploitation reports differ in scale: one firm recorded a single honeypot attempt, while ELLIO observed public exploit traffic it said could achieve a shell on vulnerable builds. Exposure depends on applications decompressing attacker-influenced Brotli data. Node.js fixed the flaw in versions 22.23.4, 24.22.1, and 26.12.1; the excerpt says upgrading is the only complete remediation and discontinued release lines should move to supported ones. FCEB agencies have until November 10, 2026, to apply fixes.

### Source excerpt

Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added two vulnerabilities impacting Adobe Commerce and Magento, and Google's Brotli decoder library to its Known Exploited V ... Read more Published Date: Oct 28, 2026 (3 hours, 20 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-111497 CVE-2026-109619 CVE-2026-109618 CVE-2026-48356

## Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento

DevFeed: [Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento](<https://devfeed.tech/articles/hackers-infect-953-online-stores-with-scanner-evading-javascript-mostly-on-magento-100949.md>)

Original publisher: [Read original article](<https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html>)

Author: The Hacker News

Published: 2026-10-26T18:12:22Z

Content type: news

Language: en

Sources: [Cyber Newsroom](<https://devfeed.tech/sources/cyber-newsroom.md>)

Topics: [Cybercrime](<https://devfeed.tech/topics/cybercrime.md>), [JavaScript](<https://devfeed.tech/topics/javascript.md>)

Tags: [campaign](<https://devfeed.tech/tags/campaign.md>), [cyber-attack](<https://devfeed.tech/tags/cyber-attack.md>), [e-commerce](<https://devfeed.tech/tags/e-commerce.md>), [e-commerce-security](<https://devfeed.tech/tags/e-commerce-security.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [magento](<https://devfeed.tech/tags/magento.md>), [malware](<https://devfeed.tech/tags/malware.md>), [scanner](<https://devfeed.tech/tags/scanner.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>), [web-security](<https://devfeed.tech/tags/web-security.md>)

### AI overview

Sansec reports a campaign active since July 2025 that injected malicious JavaScript into 953 online stores, mostly Magento. The code is staged in Magento CMS blocks and contacts attacker-controlled servers, whose loaders filter bots and security scanners so shoppers may receive malicious code while scanners receive nothing. One loader version stores its payload in browser localStorage for execution on later visits; a newer version builds bot filtering into the loader and drops the earlier Keitaro traffic-distribution component. The final payload is unknown. Sansec estimates 471 stores were injected through PolyShell (CVE-2026-48356); another 102 had files uploaded through PolyShell or SessionReaper (CVE-2025-54236). A separate reported case used a rogue administrator account despite current core patches. Site owners are advised to check for suspicious accounts and unexpected CMS blocks or pages, keep sites updated, and enforce strong passwords.

### Source excerpt

Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento An unknown threat actor has infected 953 online stores, most of them running Magento, as part of a long-running campaign active since July 2025. According to Dutch e-commerce security company Sansec, ... Read more Published Date: Oct 26, 2026 (5 hours, 50 minutes ago) Vulnerabilities has been mentioned in this article. CVE-2026-109619 CVE-2026-109618 CVE-2026-48356 CVE-2025-54236