Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper ยท updates https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026 Sansec reports a criminal group that has injected a JavaScript loader into the cms_block table of 953 online stores since July 2025, mostly Magento. The newest loader domain, deepveindrilling.com (registered Oct 6, 2026), was found on 83 stores, and since Oct 23 it fingerprints visitors so scanners get nothing. Sansec ties initial access to PolyShell (CVE-2026-48356, fixed in Adobe APSB26-73) and SessionReaper (CVE-2025-54236, APSB25-88), plus rogue admin accounts on fully patched stores. Store owners should patch, audit cms_block and cms_page, remove rogue admins and rotate credentials. en Sat, 24 Oct 2026 00:00:00 GMT Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: Sansec publishes its research: 953 stores across five loader domains since July 2025, 83 on deepveindrilling.com (60 of them earlier victims). https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026 https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-10-24-52a6b2bf Sat, 24 Oct 2026 00:00:00 GMT high <p><a href="https://sansec.io/research/magento-cms-block-loader-deepveindrilling">Source</a></p> Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: Operator rewrites the blocks with a fingerprinting loader that hides from automated browsers; 9 more stores infected, including a fully patched 2.4.7-p10 store with a rogue admin account. https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026 https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-10-23-f13cae01 Fri, 23 Oct 2026 00:00:00 GMT high <p><a href="https://sansec.io/research/magento-cms-block-loader-deepveindrilling">Source</a></p> Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: deepveindrilling.com loader (registered Oct 6) first found in store CMS blocks; 74 stores load it by the end of Oct 8. https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026 https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-10-07-33478f79 Wed, 07 Oct 2026 00:00:00 GMT high <p><a href="https://sansec.io/research/magento-cms-block-loader-deepveindrilling">Source</a></p> Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: CVE-2026-48356 (PolyShell, unrestricted file upload, CVSS 9.3) published with Adobe's fix in APSB26-73. https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026 https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2026-07-14-b908fe1c Tue, 14 Jul 2026 00:00:00 GMT high <p><a href="https://nvd.nist.gov/vuln/detail/CVE-2026-48356">Source</a></p> Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper: First loader domain, manulfie.click, appears on stores; Sansec counts 863 stores on it over the campaign. https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026 https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026#2025-07-09-33d8f93f Wed, 09 Jul 2025 00:00:00 GMT high <p><a href="https://sansec.io/research/magento-cms-block-loader-deepveindrilling">Source</a></p>