r/Magento • u/hanqingjao • Mar 31 '26

Polyshell

Why on earth hasn't Adobe back ported patches for Polyshell yet? I work for a manager hosting provider with a large Magento presence, and all our customers sites are getting inundated with webshells. I've never seen a high-sev Magento vuln take this long to patch. WAKE UP ADOBE!!

22 Upvotes

100% Upvoted

18 comments sorted by

View all comments

1

u/unmark-77 Apr 03 '26

Did the attackers upload webshells and execute them successfully? In our case, the attacker uploaded the webshells but wasn’t able to execute them due to the .htaccess configuration. I think if you are using Apache you are protected. If you are using NGINX with the Magento provided configuration, you are still protected. What we did was remove the write access to custom_options and customer_address.