# Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper · pwn.watch > Sansec reports a criminal group that has injected a JavaScript loader into the cms_block table of 953 online stores since July 2025, mostly Magento. The newest loader domain, deepveindrilling.com (registered Oct 6, 2026), was found on 83 stores, and since Oct 23 it fingerprints visitors so scanners get nothing. Sansec ties initial access to PolyShell (CVE-2026-48356, fixed in Adobe APSB26-73) and SessionReaper (CVE-2025-54236, APSB25-88), plus rogue admin accounts on fully patched stores. Store owners should patch, audit cms_block and cms_page, remove rogue admins and rotate credentials. Page: https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026 · generated 2026-10-26T23:24:06.493Z ## Status - Severity: high · status: live · patch: partial - Product: Adobe Commerce / Magento Open Source - Started: 2025-07-09 - CVEs: CVE-2026-48356, CVE-2025-54236 - Affected: Adobe Commerce and Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier without APSB26-73 (CVE-2026-48356); Stores missing APSB25-88 (SessionReaper, CVE-2025-54236); Fully patched stores that already have a rogue admin account or backdoor from an earlier compromise - Fixed in: APSB26-73 (2.4.x-2026-jul security releases) for CVE-2026-48356; APSB25-88 for CVE-2025-54236 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026.json - This file: https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026/llms.txt ## Updates (newest first) - 2026-10-24: Sansec publishes its research: 953 stores across five loader domains since July 2025, 83 on deepveindrilling.com (60 of them earlier victims). (https://sansec.io/research/magento-cms-block-loader-deepveindrilling) - 2026-10-23: Operator rewrites the blocks with a fingerprinting loader that hides from automated browsers; 9 more stores infected, including a fully patched 2.4.7-p10 store with a rogue admin account. (https://sansec.io/research/magento-cms-block-loader-deepveindrilling) - 2026-10-07: deepveindrilling.com loader (registered Oct 6) first found in store CMS blocks; 74 stores load it by the end of Oct 8. (https://sansec.io/research/magento-cms-block-loader-deepveindrilling) - 2026-07-14: CVE-2026-48356 (PolyShell, unrestricted file upload, CVSS 9.3) published with Adobe's fix in APSB26-73. (https://nvd.nist.gov/vuln/detail/CVE-2026-48356) - 2025-07-09: First loader domain, manulfie.click, appears on stores; Sansec counts 863 stores on it over the campaign. (https://sansec.io/research/magento-cms-block-loader-deepveindrilling) ## Fix brief # Security brief: Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper Source: https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026 · status: live · severity: high · updated Oct 26, 2026, 22:52 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Sansec reports a criminal group that has injected a JavaScript loader into the cms_block table of 953 online stores since July 2025, mostly Magento. The newest loader domain, deepveindrilling.com (registered Oct 6, 2026), was found on 83 stores, and since Oct 23 it fingerprints visitors so scanners get nothing. Sansec ties initial access to PolyShell (CVE-2026-48356, fixed in Adobe APSB26-73) and SessionReaper (CVE-2025-54236, APSB25-88), plus rogue admin accounts on fully patched stores. Store owners should patch, audit cms_block and cms_page, remove rogue admins and rotate credentials. Severity detail: Exploited in the wild across 953 stores; CVE-2026-48356 is CVSS 3.1 9.3 (Adobe/NVD); final payload not yet captured - Product: Adobe Commerce / Magento Open Source - CVE / advisory ids: CVE-2026-48356, CVE-2025-54236 ## Affected versions - Adobe Commerce and Magento Open Source 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier without APSB26-73 (CVE-2026-48356) - Stores missing APSB25-88 (SessionReaper, CVE-2025-54236) - Fully patched stores that already have a rogue admin account or backdoor from an earlier compromise ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - APSB26-73 (2.4.x-2026-jul security releases) for CVE-2026-48356 - APSB25-88 for CVE-2025-54236 After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Oct 24, 2026: Sansec publishes its research: 953 stores across five loader domains since July 2025, 83 on deepveindrilling.com (60 of them earlier victims). - Oct 23, 2026: Operator rewrites the blocks with a fingerprinting loader that hides from automated browsers; 9 more stores infected, including a fully patched 2.4.7-p10 store with a rogue admin account. - Oct 7, 2026: deepveindrilling.com loader (registered Oct 6) first found in store CMS blocks; 74 stores load it by the end of Oct 8. - Jul 14, 2026: CVE-2026-48356 (PolyShell, unrestricted file upload, CVSS 9.3) published with Adobe's fix in APSB26-73. - Jul 9, 2025: First loader domain, manulfie.click, appears on stores; Sansec counts 863 stores on it over the campaign. ## Advisories - [Adobe Security Bulletin APSB26-73](https://helpx.adobe.com/security/products/magento/apsb26-73.html) (Adobe) - [NVD: CVE-2026-48356](https://nvd.nist.gov/vuln/detail/CVE-2026-48356) (NVD) ## Write-ups & news - [deepveindrilling.com: Magento CMS block loader hits 953 stores](https://sansec.io/research/magento-cms-block-loader-deepveindrilling) - [Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on Magento](https://thehackernews.com/2026/10/hackers-infect-953-online-stores-with.html) - [953 Online Stores Infected in Long-Lasting Malware Campaign](https://www.securityweek.com/953-online-stores-infected-in-long-lasting-malware-campaign/) ## Caveats Indicators (Sansec): loader domains manulfie.click, neswnsssn.click, lanhd6549tdhse.top, additionalver.com and deepveindrilling.com. Check cms_block and cms_page for fpCode, se_referrer or localStorage.getItem, look for uploaded files (e.g. PolyShell webshells disguised as PNGs in pub/media/custom_options/quote/), rogue admin accounts and unknown processes. Sansec warns that deleting the script does not remove the attacker's database access: clean up, rotate database, admin and API credentials, and apply APSB26-73 and APSB25-88. --- Machine-readable: https://pwn.watch/i/magento-cms-block-loader-deepveindrilling-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.