Two Active Ecommerce Security Threats This Week: What Ops Teams Must Do in 72 Hours

Two separate ecommerce security threats went public in the last 48 hours. One is a known-exploited RCE vulnerability in Adobe Commerce and Magento. The other is a supply chain card skimmer that ran live on checkout pages for at least two days before discovery. Neither is theoretical. Both require action this week.

What Happened

Threat 1: Adobe Commerce and Magento RCE — CVE-2026-48356

On October 27, CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities catalog. The vulnerability affects Adobe Commerce and Magento Open Source across multiple version lines. An unauthenticated attacker can upload arbitrary files to the server and execute code remotely. CISA has set a federal compliance deadline of November 10, 2026. The underlying patch was published by Adobe as security bulletin APSB26-73. If your store is running an unpatched version, you have a defined window before exploitation becomes widespread.

The scope is wide. Adobe Commerce 2.4.8-p5 and earlier, 2.4.7-p10 and earlier, 2.4.6-p15 and earlier, and further back are all listed as affected. Magento Open Source follows the same version boundaries.

Source: CISA KEV Catalog | Adobe APSB26-73

Threat 2: Convertr / Plausible Analytics Supply Chain Skimmer

On October 26, Sansec published research on a Brazilian Magecart group that injected a card skimmer into the Plausible analytics script served by Convertr, a Brazilian ecommerce platform. From October 24, every checkout on every Convertr merchant loaded the infected script. It silently captured card number, expiry, CVV, cardholder name, and CPF, then exfiltrated all of it to attacker-controlled infrastructure at 1x0.is.

Convertr has since removed the skimmer and patched. The point is not the specific platform. The point is the attack surface: one analytics script, embedded on every checkout page, owned by a third party, updated on the third party's schedule. The attacker needed to compromise one file.

Source: Sansec Forensics Research

Who Is Affected

CVE-2026-48356: Any operator running Adobe Commerce or Magento Open Source on an unpatched version. This includes self-hosted Magento, cloud installations of Adobe Commerce, and any headless setup that runs Commerce as the backend. If you have a managed hosting provider, confirm they have applied APSB26-73 patches.

Convertr skimmer: Directly, merchants on the Convertr platform. More broadly, any ecommerce operation that embeds third-party analytics, checkout widgets, or utility scripts on its payment pages. Self-hosted Plausible installations are not affected by this specific incident, but the attack model applies to any external script your checkout pages load.

What to Do in the Next 24-72 Hours

For CVE-2026-48356 (Adobe Commerce / Magento):

1. Check your running version. Log into your admin panel or run bin/magento --version in the project root.
2. Cross-reference against the affected version list in APSB26-73. The bulletin lists exact patched versions for each release line.
3. If unpatched, apply the July 2026 security release for your version line. Test in staging first. If you cannot patch immediately, assess whether a Web Application Firewall rule can block unauthenticated file upload requests to the affected endpoint while you prepare.
4. Verify your hosting provider or DevOps team has confirmed the patch in production. Do not assume a managed environment means it was done automatically.
5. Note the November 10 CISA deadline. Federal contractors and agencies are under binding directive. Others should treat it as a practical deadline regardless.

For the Convertr / Plausible Supply Chain Vector:

1. Audit every script tag on your checkout and payment confirmation pages. This means the actual HTML served to users, not your source code, since CDN and analytics tags can pull remote content.
2. For each third-party script, confirm the vendor's incident notification status and check whether you are loading from their CDN or a pinned version.
3. Implement or verify Content Security Policy (CSP) headers on your checkout pages. A properly configured CSP will block outbound data exfiltration to unexpected domains even if a skimmer runs. Test yours at report-uri.com/csp or similar.
4. Check your payment processor's notifications. If you were on an affected platform, your PSP may have already flagged unusual transaction patterns.
5. If you run self-hosted analytics (Plausible, Matomo, or similar), review recent commits and file modification dates on the served script files.

What This Teaches About Fragile Ops

In both cases, the failure point was not the core platform. Magento's application logic was not bypassed through a sophisticated novel attack. A file upload endpoint that should have been locked down was not. In the Convertr case, the core platform was fine. The breach came through a measurement script that nobody on the ops team reviews, because it "just works."

Every ecommerce operation has a version of this: a tag manager container, a chat widget, an A/B testing library, a review platform embed. These scripts run on checkout pages with full DOM access, and most teams have no visibility into what they are actually doing on any given day.

The weakest link in ecommerce security is almost never the main application. It is the unreviewed dependency that runs on every transaction page because someone installed it 18 months ago and it has never caused a problem.

A quarterly audit of checkout scripts, a CSP policy that reports violations, and a clear process for acting on CVEs before CISA adds them to the KEV catalog: these are not exotic controls. They are the baseline.

If you want a team watching your ops stack for risks like these, talk to us.