{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper · updates",
  "home_page_url": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026",
  "feed_url": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026/feed.json",
  "description": "Sansec reports a criminal group that has injected a JavaScript loader into the cms_block table of 953 online stores since July 2025, mostly Magento. The newest loader domain, deepveindrilling.com (registered Oct 6, 2026), was found on 83 stores, and since Oct 23 it fingerprints visitors so scanners get nothing. Sansec ties initial access to PolyShell (CVE-2026-48356, fixed in Adobe APSB26-73) and SessionReaper (CVE-2025-54236, APSB25-88), plus rogue admin accounts on fully patched stores. Store owners should patch, audit cms_block and cms_page, remove rogue admins and rotate credentials.",
  "language": "en",
  "_pwn": {
    "slug": "magento-cms-block-loader-deepveindrilling-oct-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "partial",
    "rss": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-10-24-52a6b2bf",
      "url": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-10-24-52a6b2bf",
      "title": "Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: Sansec publishes its research: 953 stores across five loader domains since July 2025, 83 on deepveindrilling.com (60 of them earlier victims).",
      "content_text": "Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: Sansec publishes its research: 953 stores across five loader domains since July 2025, 83 on deepveindrilling.com (60 of them earlier victims).\n\nSource: https://sansec.io/research/magento-cms-block-loader-deepveindrilling",
      "date_published": "2026-10-24T00:00:00.000Z",
      "external_url": "https://sansec.io/research/magento-cms-block-loader-deepveindrilling",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-10-23-f13cae01",
      "url": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-10-23-f13cae01",
      "title": "Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: Operator rewrites the blocks with a fingerprinting loader that hides from automated browsers; 9 more stores infected, including a fully patched 2.4.7-p10 store with a rogue admin account.",
      "content_text": "Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: Operator rewrites the blocks with a fingerprinting loader that hides from automated browsers; 9 more stores infected, including a fully patched 2.4.7-p10 store with a rogue admin account.\n\nSource: https://sansec.io/research/magento-cms-block-loader-deepveindrilling",
      "date_published": "2026-10-23T00:00:00.000Z",
      "external_url": "https://sansec.io/research/magento-cms-block-loader-deepveindrilling",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-10-07-33478f79",
      "url": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-10-07-33478f79",
      "title": "Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: deepveindrilling.com loader (registered Oct 6) first found in store CMS blocks; 74 stores load it by the end of Oct 8.",
      "content_text": "Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: deepveindrilling.com loader (registered Oct 6) first found in store CMS blocks; 74 stores load it by the end of Oct 8.\n\nSource: https://sansec.io/research/magento-cms-block-loader-deepveindrilling",
      "date_published": "2026-10-07T00:00:00.000Z",
      "external_url": "https://sansec.io/research/magento-cms-block-loader-deepveindrilling",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-07-14-b908fe1c",
      "url": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-07-14-b908fe1c",
      "title": "Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: CVE-2026-48356 (PolyShell, unrestricted file upload, CVSS 9.3) published with Adobe's fix in APSB26-73.",
      "content_text": "Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: CVE-2026-48356 (PolyShell, unrestricted file upload, CVSS 9.3) published with Adobe's fix in APSB26-73.\n\nSource: https://nvd.nist.gov/vuln/detail/CVE-2026-48356",
      "date_published": "2026-07-14T00:00:00.000Z",
      "external_url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48356",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2025-07-09-33d8f93f",
      "url": "https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2025-07-09-33d8f93f",
      "title": "Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: First loader domain, manulfie.click, appears on stores; Sansec counts 863 stores on it over the campaign.",
      "content_text": "Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: First loader domain, manulfie.click, appears on stores; Sansec counts 863 stores on it over the campaign.\n\nSource: https://sansec.io/research/magento-cms-block-loader-deepveindrilling",
      "date_published": "2025-07-09T00:00:00.000Z",
      "external_url": "https://sansec.io/research/magento-cms-block-loader-deepveindrilling",
      "tags": [
        "high"
      ]
    }
  ]
}