erroneo.us
Search all guides⌘K

Digest · Saturday

Security digest: October 24, 2026

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: Magento CMS Block Loader Campaign Hits 953 Stores. Merchants, agencies and hosts running self-managed Magento Open Source or Adobe Commerce, especially stores that applied the July 2026 (APSB26-73) or SessionReaper (APSB25-88) fixes late or not at all.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2026-48356, CVE-2025-54236

Magento CMS Block Loader Campaign Hits 953 Stores

If you run Magento or Adobe Commerce, search your CMS blocks for this loader today; a store missing PolyShell or SessionReaper fixes should be treated as compromised, and a patched store is not automatically clean.

Must act: Merchants, agencies and hosts running self-managed Magento Open Source or Adobe Commerce, especially stores that applied the July 2026 (APSB26-73) or SessionReaper (APSB25-88) fixes late or not at all.

Can relax: Stores on hosted SaaS platforms such as Shopify or BigCommerce, and teams with no Magento in production.

  1. Search cms_block and cms_page for fpCode, se_referrer and localStorage.getItem, and review recently changed rows.
  2. Confirm APSB26-73 (PolyShell) and APSB25-88 (SessionReaper) are applied; upgrade to a 2026-jul or later release if not.
  3. Delete unknown admin_user accounts and remove injected blocks, then rotate admin, database and API integration credentials.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.