[{"data":1,"prerenderedAt":361},["ShallowReactive",2],{"seo-verification":3,"blog-polyshell-cve-2026-48356-magento-kev-check-and-fix-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-polyshell-cve-2026-48356-magento-kev-check-and-fix-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":30,"intro":33,"sections":34,"ctaTitle":257,"ctaBody":258,"ctaButton":259,"ctaUrl":260,"relatedPosts":261},566,"polyshell-cve-2026-48356-magento-kev-check-and-fix",{"fr":12,"en":10,"ar":13,"es":14},"polyshell-cve-2026-48356-magento-kev-verifier-corriger","ثغرة-polyshell-cve-2026-48356-ماجنتو-التحقق-والإصلاح","polyshell-cve-2026-48356-magento-kev-verificar-corregir","PolyShell CVE-2026-48356: check and fix your Magento stores","PolyShell (CVE-2026-48356) is in the KEV catalog: find Magento stores missing the APSB26-73 fix, update them, then hunt for webshells and injected JavaScript.",12,0,false,"2026-11-04T00:00:00+00:00","2026-11-04T16:30:20+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fpolyshell-cve-2026-48356-magento-kev-verifier-corriger-poster.svg","CVE-2026-48356, nicknamed PolyShell, entered the CISA KEV catalog on October 27, 2026: exploitation of Adobe Commerce and Magento Open Source stores has been observed. For an agency, the question is not only \"should we update\", but \"which stores lack the APSB26-73 fix, and which already carry a webshell\". A patch removes the flaw; it removes neither the dropped files nor the injected JavaScript. Here is the inventory, the update, four compromise checks and credential rotation, with a dated status report to hand to each client.",[35,39,71,74,84,135,154,157,178,199,203,206,215,254],{"type":36,"title":37,"body":38},"h2","PolyShell: what is established, where sources differ","CVE-2026-48356, nicknamed PolyShell, affects Adobe Commerce and Magento Open Source. The NVD entry, published on July 14, 2026 from Adobe's submission, classifies it as CWE-434 (unrestricted upload of a file with a dangerous type), with a CVSS 3.1 score of 9.3 and the vector `AV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:N`. The fix is Adobe bulletin APSB26-73. On October 27, 2026, CISA added it to its Known Exploited Vulnerabilities (KEV) catalog, with a November 10, 2026 deadline for US federal agencies: exploitation is no longer a hypothesis.\n\nThe sources do not describe the flaw the same way. NVD describes arbitrary code execution \"in the context of the current user\" that requires interaction: a victim has to visit a crafted URL or a compromised page, and the impact reaches beyond the vulnerable component. Sansec and the specialist press describe file uploads that end in webshells on the server. We do not decide between these two readings. The prudent course for an agency is to treat every store still missing the fix as a store that may already carry a webshell.",{"type":40,"title":41,"headers":42,"rows":46},"comparison","What the sources say, and what you take from them",[43,44,45],"Source","What it states","What you take from it",[47,51,55,59,63,67],[48,49,50],"NVD","CWE-434, CVSS 3.1 score of 9.3, interaction required, execution in the context of the current user","The identifiers to record in the client file",[52,53,54],"CISA, KEV catalog","Exploitation observed, added on October 27, 2026, federal deadline of November 10, 2026","A working horizon, not a comfortable date",[56,57,58],"Adobe, bulletin APSB26-73","Versions with the 2026-jul suffix are not affected","The target version for each branch",[60,61,62],"Sansec, March 30, 2026","Mass attack wave: 471 stores compromised in one hour, a PHP webshell followed by `accesson.php` backdoors","The files to look for on disk",[64,65,66],"Sansec, October 24, 2026","JavaScript loader in `cms_block`, a campaign tracked since July 2025 across 953 stores; 102 of 169 unpatched installations carried uploaded files","The queries to run on the database",[68,69,70],"Specialist press","File uploads leading to webshells","A reading to cross-check, not a primary source",{"type":36,"title":72,"body":73},"Why the patch does not close the case","Applying APSB26-73 removes the flaw. It removes nothing that has already come in. A webshell dropped before the update stays on disk, an `accesson.php` backdoor keeps answering, a script injected into `cms_block` keeps being served to every visitor, and an admin account created by the attacker stays valid. Sansec puts it this way: removing the scripts does not remove the attacker's access.\n\nSansec's second study shows why the question applies to a whole portfolio. Of 169 unpatched Magento 2 installations examined, 102 carried files uploaded through PolyShell or SessionReaper (CVE-2025-54236, fixed by bulletin APSB25-88), which is 60%. The order of work is therefore fixed: inventory, frozen state, update, search for traces, credential rotation, then a dated status report for the client. Skipping the rotation to save an hour leaves the attacker the keys they may already have copied.",{"type":75,"title":76,"items":77},"ul","What this procedure leaves in your hands",[78,79,80,81,82,83],"**An inventory per store** — edition (Commerce or Open Source), exact version, whether the 2026-jul fix is present.","**A target version per branch** — read from bulletin APSB26-73, with no guessing at the numbering.","**A frozen state before any work** — snapshot and database export kept as evidence, before any cleanup.","**Four repeatable checks** — files under `pub\u002Fmedia`, `accesson.php` backdoors, JavaScript in `cms_block` and in `cms_page`.","**A complete credential rotation** — admin accounts, API and integration keys, database, encryption key, SSH and SFTP.","**A dated status report for each client** — what was checked, found and fixed, and what was not.",{"type":40,"title":85,"headers":86,"rows":90},"Affected and fixed versions according to APSB26-73",[87,88,89],"Product and branch","Affected up to","Fixed version",[91,95,99,103,107,111,115,117,119,121,123,127,131],[92,93,94],"Adobe Commerce 2.4.9","2.4.9","2.4.9-2026-jul",[96,97,98],"Adobe Commerce 2.4.8","2.4.8-p5","2.4.8-2026-jul",[100,101,102],"Adobe Commerce 2.4.7","2.4.7-p10","2.4.7-2026-jul",[104,105,106],"Adobe Commerce 2.4.6","2.4.6-p15","2.4.6-2026-jul",[108,109,110],"Adobe Commerce 2.4.5","2.4.5-p17","2.4.5-2026-jul",[112,113,114],"Adobe Commerce 2.4.4","2.4.4-p18","2.4.4-2026-jul",[116,93,94],"Magento Open Source 2.4.9",[118,97,98],"Magento Open Source 2.4.8",[120,101,102],"Magento Open Source 2.4.7",[122,105,106],"Magento Open Source 2.4.6",[124,125,126],"Adobe Commerce B2B","1.5.3, 1.5.2-p5, 1.4.2-p10, 1.3.4-p17, 1.3.3-p18","1.5.3-2026-jul, 1.5.2-2026-jul, 1.4.2-2026-jul, 1.3.4-2026-jul, 1.3.3-2026-jul",[128,129,130],"Adobe Commerce Events","1.20.0 and earlier","1.21.0",[132,133,134],"Magento Open Source 2.4.5 and 2.4.4","Not in the NVD list","No conclusion: read the Adobe advisory",{"type":136,"title":137,"steps":138},"steps","Inventory the version of every store",[139,142,145,148,151],{"title":140,"body":141},"Read the declared version","`cd \u002Fvar\u002Fwww\u002Fclient-store`\n`bin\u002Fmagento --version`\nThe command prints the edition and the number. The path is an example: adapt it to each hosting setup. Run it as the system user that owns the files, not as root, so you do not change the cache permissions.",{"title":143,"body":144},"Cross-check with Composer","`composer show magento\u002Fproduct-community-edition`\nfor Magento Open Source, or\n`composer show magento\u002Fproduct-enterprise-edition`\nfor Adobe Commerce. Composer reads what is actually installed. If the two readings differ, Composer is authoritative, and the gap gets recorded.",{"title":146,"body":147},"Sweep an entire server","`find \u002Fvar\u002Fwww \u002Fhome -name composer.lock -not -path '*\u002Fvendor\u002F*' -exec grep -H -A1 '\"name\": \"magento\u002Fproduct-' {} +`\nEach file listed belongs to a Magento installation, and the `version` line follows the package name. A public staging site or an old unpacked copy counts as a store: it is exposed in the same way if it is served.",{"title":149,"body":150},"Classify with the version table","Compare the number you found with the table above. Reading rule: any version without the 2026-jul suffix for its branch needs action. For Magento Open Source 2.4.5 and 2.4.4, which are not in the NVD list, do not write \"not affected\": refer to the Adobe bulletin and treat the store as exposed until you have read otherwise.",{"title":152,"body":153},"Record one row per store","Client, server, path, edition, version found, date and time of the check. Add right away the columns you will need later: fix applied, result of the four checks, credentials rotated. This table becomes the central document of the file handed to the client.",{"type":36,"title":155,"body":156},"Freeze the state before touching anything: it is also evidence","Before any change, freeze the store as you found it. On a VPS, a VPS snapshot, if your host offers one, captures the whole disk; add a database export and a code archive on storage the update does not touch. The difference between the two tools is covered in \u003Ca href=\"\u002Fen\u002Fblog\u002Fvps-snapshot-vs-backup-what-differs-and-how-restore-works\">our snapshot versus backup comparison\u003C\u002Fa>.\n\nThis state serves twice. It lets you roll back if the update breaks checkout. Above all, it preserves evidence: if the attacker got in, the dropped files, their dates and the modified CMS blocks are in this copy, and nowhere else once the cleanup is done. CISA also points to its forensic triage requirements for affected systems. Do not delete or overwrite this state until the case is closed.\n\nA branch upgrade, from 2.4.6 to 2.4.9 for example, is a separate project: its Composer procedure and support calendar are in \u003Ca href=\"\u002Fen\u002Fblog\u002Fmagento-2-4-6-end-of-support-upgrade-to-2-4-9\">our upgrade guide\u003C\u002Fa>. Here, each store stays on its branch and only receives the fix.",{"type":136,"title":158,"steps":159},"Apply the fix without a long outage",[160,163,166,169,172,175],{"title":161,"body":162},"Rehearse on a staging copy","Restore the frozen state to a staging environment, or clone the store, and run the update there first. Time each command: that duration sets the maintenance window you announce to the client.",{"title":164,"body":165},"Pin the fixed version","`composer require magento\u002Fproduct-community-edition=\u003Cfixed-version> --no-update`\nReplace the package with `magento\u002Fproduct-enterprise-edition` for Adobe Commerce, and `\u003Cfixed-version>` with the 2026-jul version of your branch, exactly as the bulletin writes it.",{"title":167,"body":168},"Resolve and validate the lock file","`composer update magento\u002Fproduct-community-edition --with-all-dependencies`\nReview the list of changed packages. The `composer.lock` you obtain and test is the one you will deploy: production no longer resolves anything, it installs.",{"title":170,"body":171},"Open the maintenance window in production","`bin\u002Fmagento maintenance:enable`\n`bin\u002Fmagento maintenance:allow-ips \u003Cyour-ip>`\nEverything before this point happened without stopping sales. The second command lets you test the store before it reopens.",{"title":173,"body":174},"Install and apply","`composer install --no-dev`\n`bin\u002Fmagento setup:upgrade`\n`bin\u002Fmagento setup:di:compile`\n`bin\u002Fmagento setup:static-content:deploy`\nWith a lock file already validated, the outage is limited to these four commands.",{"title":176,"body":177},"Reopen and verify","`bin\u002Fmagento maintenance:disable`\n`composer show magento\u002Fproduct-community-edition`\nThe installed version must be the fixed version of your branch. Place an order with the payment gateway in test mode, then record the version and time in the table.",{"type":136,"title":179,"steps":180},"Look for traces of compromise",[181,184,187,190,193,196],{"title":182,"body":183},"List files dropped under pub\u002Fmedia","`find pub\u002Fmedia\u002Fcustom_options\u002F pub\u002Fmedia\u002Fcustomer_address\u002F -type f ! -name '.htaccess'`\nA command published by Sansec, to run from the store root. Every file listed needs review, especially a PHP script. Copy it outside the public tree with its modification date before deleting it.",{"title":185,"body":186},"Search for accesson.php backdoors","`find . -name 'accesson.php' -type f`\nSansec reports this file \"in multiple directories\": run the search from the root, not only under `pub\u002F`. An empty result proves that this particular file is absent, not that no backdoor exists.",{"title":188,"body":189},"Query the cms_block table","`SELECT block_id, identifier, update_time FROM cms_block WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%' OR content LIKE '%localStorage.getItem%';`\nA query published by Sansec. Add the installation's table prefix if there is one. The `update_time` column helps date the injection.",{"title":191,"body":192},"Query the cms_page table","`SELECT page_id, identifier, update_time FROM cms_page WHERE content LIKE '%fpCode%' OR content LIKE '%se_referrer%' OR content LIKE '%localStorage.getItem%';`\nThe same check on CMS pages. A result is not necessarily malicious: `localStorage.getItem` can appear in a legitimate script. Read the content before concluding.",{"title":194,"body":195},"Match against published indicators","For the March 2026 wave, Sansec published a loader domain, `lanhd6549tdhse.top`, a localStorage key, `136c1e07507f4a97`, and a backdoor marker, `8194460`. Look for them in the previous results and in the files you found, for example with `grep -rl 'lanhd6549tdhse' pub\u002F app\u002F`. This list is not exhaustive: their absence does not clear a store.",{"title":197,"body":198},"Check administrator accounts","`SELECT user_id, username, email, created, logdate, is_active FROM admin_user ORDER BY created DESC;`\nAn account nobody recognizes, or one created close to the date of a suspicious file, gets disabled and then documented. The monthly check of these points on each client VPS is described in \u003Ca href=\"\u002Fen\u002Fblog\u002Fmonthly-security-audit-checklist-client-vps-agency\">our audit checklist\u003C\u002Fa>.",{"type":200,"title":201,"body":202},"tip","Hardening: PHP has no business under pub\u002Fmedia","Independently of PolyShell, a directory that receives files sent by visitors should never execute PHP. Check that your nginx or Apache configuration refuses to execute scripts under `pub\u002Fmedia`, and test it on staging with a harmless file. This is not a mitigation published by Adobe for this CVE, and it does not replace the fix: it is general hardening that reduces the effect of a future successful upload.",{"type":36,"title":204,"body":205},"Troubleshooting: common blockers during the procedure","**\"Your requirements could not be resolved to an installable set of packages.\"** Composer refuses the requested version: a third-party module pins a dependency, or the stability constraint in `composer.json` excludes the target version. The command `composer why-not magento\u002Fproduct-community-edition \u003Cfixed-version>` names the package that blocks. Sort it out on staging, never in production.\n\n**\"Please upgrade your database: Run \"bin\u002Fmagento setup:upgrade\" from the Magento root directory.\"** The store shows this message after the code update: the `setup:upgrade` step was not run, or it failed. Run it again, then the compilation.\n\n**\"Table '…cms_block' doesn't exist\"** when running the Sansec query: the installation uses a table prefix. Read the prefix in the store configuration and add it to the table name.\n\n**\"No such file or directory\"** on the `pub\u002Fmedia` `find` command: the `custom_options` or `customer_address` directory does not exist on this store. Record it in the table; it is neither a failure nor proof that the store is clean.\n\n**A store that stays in maintenance**: check that no maintenance flag remains and run `bin\u002Fmagento maintenance:disable` again as the user that owns the files.",{"type":75,"title":207,"items":208},"After the cleanup: what must be rotated",[209,210,211,212,213,214],"**Administrator passwords** — every account in `admin_user`, including the ones you consider sound.","**API keys and integrations** — tokens of the integrations declared in the admin, keys for third-party services (payment, shipping, ERP) stored in the configuration.","**Database credentials** — a new password, updated in the store configuration.","**Encryption key** — to be changed following the Adobe documentation, after assessing the effect on data that is already encrypted.","**SSH and SFTP access** — passwords, authorized SSH keys, unknown system accounts.","**Hosting access** — control panel and backups, which also give access to the files.",{"type":40,"title":216,"headers":217,"rows":221},"The dated status report to hand to each client",[218,219,220],"Column","What you write","Why",[222,226,230,234,238,242,246,250],[223,224,225],"Version before and after","Numbers read by Composer, with date and time","Shows that the APSB26-73 fix is in place",[227,228,229],"Frozen state","Reference of the snapshot and of the database export","Allows rollback and forensic review",[231,232,233],"Files under pub\u002Fmedia","Paths and dates of the files found, or \"none\"","Check published by Sansec",[235,236,237],"accesson.php","Paths found, or \"none\"","Backdoor reported by Sansec",[239,240,241],"cms_block and cms_page","Identifiers listed and verdict after reading","Injected JavaScript served to visitors",[243,244,245],"Admin accounts","Unknown accounts disabled, or \"none\"","Access left by the attacker",[247,248,249],"Credentials rotated","Secrets changed and date of the change","Closes what the attacker may have copied",[251,252,253],"Not checked","What you could not look at, and why","An honest status beats an \"all is well\"",{"type":36,"title":255,"body":256},"What you keep, and the sources to cite","When a store is found compromised, the agency is the one the client calls. Keep that role: you hold the relationship, the diagnosis and the dated report; the platform holds the infrastructure, the root access to the VPS that lets you run these checks, and the snapshot before any work. We do not change a store's code on your behalf: updating Magento remains the agency's task. Keep the table template as well: the next flaw affecting a store will follow the same sequence, with one more row in the inventory.\n\nPrimary sources:\n\u003Ca href=\"https:\u002F\u002Fnvd.nist.gov\u002Fvuln\u002Fdetail\u002FCVE-2026-48356\">NVD entry for CVE-2026-48356\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fhelpx.adobe.com\u002Fsecurity\u002Fproducts\u002Fmagento\u002Fapsb26-73.html\">Adobe bulletin APSB26-73\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F27\u002Fcisa-adds-two-known-exploited-vulnerabilities-catalog\">CISA alert of October 27, 2026\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fsansec.io\u002Fresearch\u002Fpolyshell-mass-attack-wave\">Sansec, PolyShell mass attack wave\u003C\u002Fa>\n\u003Ca href=\"https:\u002F\u002Fsansec.io\u002Fresearch\u002Fmagento-cms-block-loader-deepveindrilling\">Sansec, JavaScript loader in cms_block\u003C\u002Fa>","A portfolio of stores, a single inventory","For a portfolio of client stores, the real cost is the lack of an inventory. On the agencies page, see how to centralize the portfolio, the infrastructure and its status in one place: you keep the client relationship, we hold the infrastructure.","See the agency solution","\u002Fsolutions\u002Fagences",[262,278,299,314,330,348],{"id":263,"slug":264,"slugs":265,"title":269,"excerpt":270,"readTime":271,"views":18,"isPinned":19,"publishedAt":272,"updatedAt":273,"category":274,"categories":275,"featuredImage":30,"bgImage":31,"posterImage":277,"relatedSolution":30},557,"magento-2-4-6-end-of-support-upgrade-to-2-4-9",{"fr":266,"en":264,"ar":267,"es":268},"magento-2-4-6-fin-de-support-mise-a-niveau-2-4-9","ماجنتو-2-4-6-نهاية-الدعم-الترقية-إلى-2-4-9","magento-2-4-6-fin-de-soporte-actualizar-a-2-4-9","Magento 2.4.6 out of support: upgrade to 2.4.9, short cutover","Standard support for Magento 2.4.6 has ended. Adobe's dates, the server stack 2.4.9 needs, and a Composer upgrade rehearsed in staging, with downtime cut to the switch.",9,"2026-11-01T00:00:00+00:00","2026-11-01T14:14:31+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[276],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fmagento-2-4-6-fin-de-support-mise-a-niveau-2-4-9-poster.svg",{"id":279,"slug":280,"slugs":281,"title":285,"excerpt":286,"readTime":287,"views":287,"isPinned":19,"publishedAt":288,"updatedAt":289,"category":290,"categories":296,"featuredImage":30,"bgImage":31,"posterImage":298,"relatedSolution":30},151,"how-to-install-magento-on-a-vps",{"fr":282,"en":280,"ar":283,"es":284},"installer-magento-vps","كيفية-تثبيت-magento-على-vps","como-instalar-magento-en-un-vps","How to install Magento on a VPS","Install Magento on a ServOrbit VPS: complex catalogue, Docker stack, HTTPS and a link to the official Adobe Commerce documentation.",3,"2026-01-25T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":291,"name":292,"slug":293,"color":294,"icon":295},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[297],{"id":291,"name":292,"slug":293,"color":294,"icon":295},"\u002Fblog\u002Fcovers\u002Finstaller-magento-vps-poster.svg",{"id":300,"slug":301,"slugs":302,"title":306,"excerpt":307,"readTime":271,"views":18,"isPinned":19,"publishedAt":308,"updatedAt":309,"category":310,"categories":311,"featuredImage":30,"bgImage":31,"posterImage":313,"relatedSolution":30},548,"vps-snapshot-vs-backup-what-differs-and-how-restore-works",{"fr":303,"en":301,"ar":304,"es":305},"snapshot-vs-sauvegarde-vps-difference-restauration","اللقطة-مقابل-النسخ-الاحتياطي-للـvps-الفرق-والاستعادة","snapshot-vs-copia-de-seguridad-de-vps-diferencias-y-restauracion","VPS snapshot vs backup: what differs and how restore works","VPS snapshot or backup: what each one protects, what it does not, how restoring works, and a decision rule for the VPS you run for your clients.","2026-10-31T00:00:00+00:00","2026-10-31T19:07:30+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[312],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fsnapshot-vs-sauvegarde-vps-difference-restauration-poster.svg",{"id":315,"slug":316,"slugs":317,"title":321,"excerpt":322,"readTime":323,"views":18,"isPinned":19,"publishedAt":324,"updatedAt":325,"category":326,"categories":327,"featuredImage":30,"bgImage":31,"posterImage":329,"relatedSolution":30},521,"monthly-security-audit-checklist-client-vps-agency",{"fr":318,"en":316,"ar":319,"es":320},"checklist-audit-securite-mensuel-vps-clients-agence","قائمة-تدقيق-أمان-vps-شهرية-للعملاء-للوكالات","auditoria-seguridad-mensual-vps-clientes-agencia-checklist","Monthly client VPS security audit: a 45-minute checklist","Seven checks to run every month on a client VPS: updates, kernel, SSH accounts, ports, certificates, backups, logs. Includes a dated one-page report.",10,"2026-10-28T00:00:00+00:00","2026-10-29T03:10:22+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[328],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fchecklist-audit-securite-mensuel-vps-clients-agence-poster.svg",{"id":331,"slug":332,"slugs":333,"title":337,"excerpt":338,"readTime":323,"views":18,"isPinned":19,"publishedAt":339,"updatedAt":340,"category":341,"categories":342,"featuredImage":30,"bgImage":31,"posterImage":344,"relatedSolution":345},525,"bricksforge-cve-2026-85097-wordpress-update",{"fr":334,"en":332,"ar":335,"es":336},"bricksforge-cve-2026-85097-wordpress-mettre-a-jour","ثغرة-bricksforge-cve-2026-85097-ووردبريس-التحديث","bricksforge-cve-2026-85097-wordpress-actualizar","Bricksforge CVE-2026-85097: update and audit your WordPress fleet","Bricksforge 3.1.8.10 fixes CVE-2026-85097, an exploited unauthenticated upload. wp-cli inventory, dropped PHP files, access logs, secrets to rotate.","2026-10-29T00:00:00+00:00","2026-10-29T15:45:55+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[343],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fbricksforge-cve-2026-85097-wordpress-mettre-a-jour-poster.svg",{"categorySlug":346,"appSlug":347},"cms-websites","wordpress",{"id":349,"slug":350,"slugs":351,"title":355,"excerpt":356,"readTime":323,"views":18,"isPinned":19,"publishedAt":272,"updatedAt":273,"category":357,"categories":358,"featuredImage":30,"bgImage":31,"posterImage":360,"relatedSolution":30},556,"drupal-commerce-cve-2026-118539-update-and-audit-orders",{"fr":352,"en":350,"ar":353,"es":354},"drupal-commerce-core-cve-2026-118539-sa-contrib-2026-254-mettre-a-jour","ثغرة-drupal-commerce-cve-2026-118539-التحديث-وتدقيق-الطلبات","drupal-commerce-cve-2026-118539-actualizar-y-auditar-pedidos","Drupal Commerce CVE-2026-118539: patch and audit orders","Commerce Core flaw under exploitation, advisory SA-CONTRIB-2026-254: find affected versions, move to 3.3.13 or 8.x-2.41, then audit your orders.",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[359],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fdrupal-commerce-core-cve-2026-118539-sa-contrib-2026-254-mettre-a-jour-poster.svg",1793820068572]