A critical PHP vulnerability has put Magento stores at risk, and attackers are already attempting to exploit it. Sansec have demonstrated unauthenticated remote code execution against Magento 2.4.9, while Cloudflare detected attack traffic before the official security fixes were released. The issue involves two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell. Both carry a… Read More
If your Magento store was reachable between September 4 and the moment you applied Adobe’s hotfix, you have two jobs this week, not one. Patch, then find out whether someone already walked in. Sansec disclosed Magento StyleSmuggler on September 5. Attacks had already been running since September 4, three days before a fix existed. Here… Read More
A new security vulnerability in Magento and Adobe Commerce was publicly disclosed on March 17, 2026. Named PolyShell, it allows attackers to upload executable files to any store through the REST API — without needing an account or login. No production patch exists yet, and the exploit method is already circulating.
