Netcraft Reports Defacement Campaign Affecting Over 7,500 Magento Sites

Summary

Netcraft reports a defacement campaign affecting over 7,500 Magento sites across more than 15,000 hostnames, likely exploiting unauthenticated file upload. Separately, Sansec says no in-the-wild exploitation of the PolyShell flaw has been observed.

Key points

Netcraft reports that the campaign began three weeks before publication and affected over 7,500 Magento sites across more than 15,000 hostnames.
Attackers placed plaintext defacement files directly on affected infrastructure; most contained attacker handles.
Netcraft says most incidents were reported to Zone-H by the account “Typical Idiot Security,” the same handle found in defacement messages.
Netcraft suspects exploitation of an unauthenticated file-upload vulnerability and says it uploaded a text file to a test instance running the latest Magento Community version.
Affected sites included global brands, government services, universities and nonprofits; most were subdomains, regional storefronts or staging environments, though some production-facing sites were briefly defaced.
Separately, Sansec reported PolyShell, an unauthenticated Magento and Adobe Commerce REST API flaw that can allow executable uploads. Sansec said it had not observed active exploitation; it reported a fix in the 2.4.9 pre-release branch, with no isolated patch for current production versions.

Article Details

Event Type: Ongoing mass defacement campaign targeting Magento sites, alongside a separately reported unauthenticated file-upload vulnerability named PolyShell.
Impact: Netcraft reported more than 7,500 Magento sites defaced across over 15,000 hostnames. Affected environments included subdomains, regional storefronts, staging sites, and some production-facing sites, as well as sites associated with global brands, government services, universities, and nonprofit organizations. Sansec said PolyShell could allow unauthenticated uploads of executables and could enable XSS in versions before 2.3.5, but reported no observed active exploitation; it said the exploit method was circulating and expected automated attacks.