Attacks taking advantage of the ‘PolyShell’ security flaw in Magento Open Source and Adobe Commerce version 2 are active, impacting over half of susceptible online stores.

According to the eCommerce security firm Sansec, hackers began widely exploiting the critical PolyShell weakness last week, just two days after it was publicly revealed.

“Widespread exploitation of PolyShell started on March 19th, and Sansec has now identified PolyShell attacks on 56.7% of all vulnerable stores,” Sansec states.

The researchers previously indicated that the vulnerability exists in Magento’s REST API, which allows file uploads as part of the custom options for items in the shopping cart. If the web server configuration permits it, this enables polyglot files to achieve remote code execution or take over accounts via stored cross-site scripting (XSS).

Adobe released a fix in version 2.4.9-beta1 on March 10, 2026, however it hasn’t been implemented in the stable version. BleepingComputer previously reached out to Adobe for information on when a security update addressing PolyShell would be available for production versions, but they haven’t received a reply.

Meanwhile, Sansec has posted a list of IP addresses detected scanning for online stores with the PolyShell vulnerability.

Sansec also reported that in some attacks likely exploiting PolyShell, the attacker is using a new payment card skimmer that utilizes Web Real-Time Communication (WebRTC) to steal data.

WebRTC uses DTLS-encrypted UDP, not HTTP, making it more likely to bypass security measures even on sites with strong Content Security Policy (CSP) controls, such as “connect-src.”

The skimmer is a simple JavaScript loader that connects to a pre-programmed command-and-control (C2) server via WebRTC, circumventing normal signaling by including a fraudulent SDP exchange.

It receives a second-stage payload via the encrypted channel and executes it while bypassing CSP. This is mainly done by reusing an existing script nonce or by resorting to unsafe-eval or directly injecting scripts. Execution is delayed using ‘requestIdleCallback’ to make detection harder.

Sansec pointed out that this skimmer was found on the e-commerce site of a car manufacturer worth over $100 billion, which did not respond to their alerts.

The researchers provide a series of compromise indicators to help defenders protect themselves from these attacks.