Security notice

Run a Magento store? Criminals are hiding code in store databases where scanners cannot see it. Check yours today.

Last updated: Wednesday, October 28, 2026, 9:06 AM ETStatus: Active campaign. Check your store's CMS blocks now.

On October 24, 2026, ecommerce security firm Sansec reported that a criminal group has planted hidden code in 953 online stores since July 2025, mostly stores built on Magento. In October the group switched to a new web address, deepveindrilling[.]com, which Sansec found on 83 stores. The code does not sit in the store's theme files. It sits in the store's database, in the CMS blocks that Magento shows on store pages. Since October 23 it checks whether each visitor is a real shopper or a security scanner, and scanners get a clean page. Sansec says that if your store loads this code, the attacker can write to your database, and deleting the script does not remove that access. If you run a Magento or Adobe Commerce store, have your developer check the database today.

Update, October 27, 2026, afternoon

CISA has added PolyShell (CVE-2026-48356), the Magento and Adobe Commerce file upload flaw that Sansec tied to an earlier wave of this campaign, to its list of flaws known to be exploited. If your store is behind on Adobe's July patch, install it now and run the checks on this page.

CISA lists PolyShell as exploited. On October 27, CISA added CVE-2026-48356, which it calls "Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability," to its Known Exploited Vulnerabilities (KEV) catalog "based on evidence of active exploitation." US federal civilian agencies must fix it by November 10, 2026. That rule applies only to federal agencies, but CISA says it "encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities." CISA's notice does not say who is being attacked or how. (CISA, CISA KEV catalog)
Adobe's bulletin still says it is not aware of exploits. Adobe's bulletin APSB26-73, published July 14 and last updated August 11, says Adobe "is not aware of any exploits in the wild for any of the issues addressed in these updates." That predates CISA's listing, and Sansec has reported attacks using this flaw since March 2026, months before Adobe's patch for supported versions. Both statements are on the record. We are quoting each as its own source. (Adobe APSB26-73, Sansec PolyShell)
What Adobe says about the flaw. Adobe rates CVE-2026-48356 critical, with a score of 9.6 out of 10, and says no login is needed to exploit it. The fix is the July 2026 release for your version: 2.4.9-2026-jul down to 2.4.4-2026-jul for Adobe Commerce, and 2.4.9-2026-jul down to 2.4.6-2026-jul for Magento Open Source. Adobe lists no July update for Magento Open Source older than 2.4.6, so if you run an older Open Source version, ask your developer about upgrading. (Adobe APSB26-73)
An uploaded file stays on the server. Sansec says the flaw lets an attacker upload a file disguised as an image through the store's REST API, that whether it can run as code depends on the web server's setup, and that even when it cannot run, "the uploaded file stays on disk." That is why the file checks below matter even after you patch. (Sansec PolyShell)

What to do

The advice on this page has not changed. If your store is behind on APSB26-73, install the July release for your version now. Whether or not you are patched, have your developer run the checks below for the loader, uploaded files in pub/media/custom_options/ and webshells, because patching does not remove an attacker who is already inside. EverThread does not test for this flaw or for the loader. Our scans check your store from the outside and cannot see which Adobe patches your store has installed or what is in your database or upload folders. (Adobe APSB26-73, Sansec PolyShell)

What happened

A new address, the same group. Sansec found deepveindrilling[.]com in the CMS blocks of 83 online stores, nearly all on Magento. The address was registered on October 6, 2026, and the first stores loaded it the next evening. Sansec says it is the fifth address of a campaign it has tracked since July 2025, which has reached 953 stores, and that the group moves to a new address every few months. Do not visit the address. (Sansec)
Most victims were already infected. Sansec says 60 of the 83 stores already ran one of the group's earlier versions, 34 of them since October 2025. A store that was infected once and not fully cleaned can be reused months later. (Sansec)
It hides in the database, not the theme. The code lives in Magento's cms_block table, which holds the static content blocks Magento puts into store pages. Sansec says its eComscan tool found it there on 148 server installs over the course of the campaign, and never in theme files or in core_config_data. A developer who only checks theme files will miss it. (Sansec)
It hides from scanners. On October 23 the group rewrote the blocks again. The new version sends a fingerprint of each visitor's browser to the attacker's server and flags automated browsers, the kind security scanners use. Sansec says that when the urlscan.io service loaded an infected store with an automated browser, the page came back with no added content. All 71 stores Sansec re-checked by October 24 run this new version. (Sansec)
It keeps running in shoppers' browsers. Sansec says the code stores the attacker's script in the shopper's browser and runs it again on every later page view, even when the attacker's address is offline or blocked. Shoppers' browsers run whatever script the attacker's server sends back. (Sansec)
What it delivers now is unknown. Sansec has not captured the final payload yet. In December 2025, its monitoring saw earlier versions send real visitors scripts from web addresses including one that misspells the crypto wallet brand Ledger. (Sansec)
How the stores were broken into. Sansec says the October changes used no new flaw, because most of the stores were already infected. Earlier waves point to Magento file upload flaws. In March 2026, the group put its code on 471 stores in one hour after uploading attack files through PolyShell (CVE-2026-48356). Of 169 infected installs that were missing at least one Magento security patch, Sansec says 102 also had files uploaded through PolyShell or SessionReaper (CVE-2025-54236). (Sansec, Sansec PolyShell)
Fully patched stores were hit too. Sansec says one store on Magento 2.4.7-p10, with no missing security patches, got the new address on October 23, one hour after a clean scan. Sansec had earlier found a rogue admin account on that store in September and a backdoor a week later. Patching closes the holes. It does not remove an attacker who is already inside. (Sansec)

Who should worry

Shoppers on an infected store run code the attacker controls, and the attacker decides, visitor by visitor, what that code does. The store owner may see nothing wrong.

Ask about this if any of these are true:

You run an online store on Magento Open Source or Adobe Commerce.
Your store has ever been behind on Adobe security patches, especially APSB26-73 (PolyShell) or APSB25-88 (SessionReaper).
Your store has had a break-in or malware before. Sansec says most stores on the new address were earlier victims.
A developer or agency runs Magento stores for you or for your clients.

Sansec says the stores were nearly all on Magento. If your store runs on something else, this campaign is unlikely to be your problem, but the same advice about patching and unknown admin accounts still applies.

What to do now

Do these today.

Ask the question. Send the message below to your developer, agency or host. You need a clear yes or no: do our Magento CMS blocks or CMS pages contain this code, and are all Adobe security patches installed?
Search the database, not just the files. Sansec says the attacker's addresses are often hidden in encoded form, so search the CMS content for the code patterns listed under Technical steps below. (Sansec)
If the code is there, treat the store as broken into. Sansec says the attacker can write to your database, and deleting the script does not remove that access. Find and close the way in, remove admin accounts you do not recognize and any backdoor files, then change the database, admin and API integration passwords. (Sansec)
Install the missing patches. Sansec says to install APSB26-73 for PolyShell and APSB25-88 for SessionReaper. Also install Adobe's October patch for a separate, newer flaw, BlockStrap. See our BlockStrap notice. (Sansec, Adobe APSB26-73, Adobe APSB25-88)
Get experienced help if you find anything. Cleaning a store the attacker can still write to does not last. A Magento specialist or incident response firm should handle the cleanup.
If the answer is "I don't know", that is not a no. Ask them to run the checks below.

What to send your developer, agency or host

On October 24, 2026, Sansec reported a campaign that has planted a JavaScript loader in the CMS blocks of 953 stores since July 2025, mostly Magento. The current loader domain is deepveindrilling[.]com, and since October 23 the loader fingerprints visitors and shows nothing to automated scanners. The code lives in cms_block.content, not in theme files. Please search cms_block and cms_page for fpCode, se_referrer and localStorage.getItem, check pub/media/custom_options/ and pub/media/customer_address/ for uploaded files, search for accesson.php, and review admin_user for accounts we do not recognize. If anything turns up, please find how the attacker got in, clean up, then change the database, admin and API integration passwords. Please also confirm that APSB26-73, APSB25-88 and the October 2026 APSB26-153 patch are installed, and tell us what you find. Source: Sansec.

Technical steps

Step 1. Search CMS blocks and pages

Sansec says the domains are often base64 encoded, so search for the code patterns instead:

SELECT block_id, identifier, update_time FROM cms_block
WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%'
OR content LIKE '%localStorage.getItem%';

Run the same search on cms_page. If your store uses a table prefix, add it. Sansec says update_time shows the attacker's most recent write. Keep a copy of anything you find before you remove it. (Sansec)

Step 2. Find the way in

find pub/media/custom_options/ pub/media/customer_address/ -type f ! -name '.htaccess'
find . -name 'accesson.php' -type f

Sansec says to check admin_user for accounts you do not recognize and to look for unfamiliar processes on the server. (Sansec)

Step 3. Clean up, then change credentials

Remove the scripts, unknown admin accounts and backdoor files. After cleanup, change the database, admin and API integration passwords, as Sansec advises. Changing them before the way in is closed does not help. (Sansec)

Step 4. Patch

Install APSB26-73, Adobe's fix for PolyShell on supported release lines, and APSB25-88 for SessionReaper. Then install APSB26-153 for BlockStrap, with the September StyleSmuggler hotfix kept in place. (Sansec, Adobe APSB26-73, Adobe APSB25-88, our BlockStrap notice)

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. Sansec has not published the names of affected stores. Only a check of your store's database and server can tell whether this code is there.

Can EverThread tell me if I am affected?

No. EverThread checks your website from the outside, the way a browser sees it. Our scan does not look inside your database or your CMS blocks, and it does not detect this campaign. Sansec says the attacker's server is built to show automated scanners a clean page, so a clean EverThread result does not mean your store is clean. We do not clean up infected stores. Your developer or a Magento security specialist can check and clean your store. Our free scan looks at your home page from the outside for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

We deleted the script. Are we done?

No. Sansec says the attacker can write to your database, and deleting the script does not remove that access. Find and close the way in, remove unknown admin accounts and backdoors, then change the database, admin and API integration passwords. (Sansec)

Our store is fully patched. Are we safe?

Not necessarily. Sansec found the new address on a store with no missing security patches, which already had a rogue admin account and a backdoor. Patches stop new break-ins through those flaws. They do not remove an attacker who got in earlier. (Sansec)

Where can I follow official updates?

Sansec's research post has the details, and Adobe's security bulletins APSB26-73 and APSB25-88 list the patches.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

Sansec: deepveindrilling[.]com: Magento CMS block loader hits 953 stores, October 24, 2026
Sansec: PolyShell: unrestricted file upload in Magento and Adobe Commerce, March 17, 2026
Sansec: SessionReaper, unauthenticated RCE in Magento and Adobe Commerce (CVE-2025-54236), September 8, 2025
Adobe: Security bulletin APSB26-73
Adobe: Security bulletin APSB25-88
CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog, October 27, 2026
CISA: Known Exploited Vulnerabilities Catalog, catalog version dated October 27, 2026, checked October 27, 2026
Adobe: Security update available for Adobe Commerce | APSB26-73, published July 14, 2026, last updated August 11, 2026, checked October 27, 2026