Adobe Commerce and Magento Open Source stores: install the July security patch
In plain English
The US cybersecurity agency (CISA) has added a vulnerability nicknamed "PolyShell" to its list of known exploited flaws. It affects Adobe Commerce and Magento Open Source stores that haven't installed recent security updates. Adobe released a fix in its July 2026 security update.
Why it matters
Stores that are fully up to date are protected. Keeping security patches current is the simplest way to keep your store and your customers' data safe.
What to do
- 1Confirm the July 2026 patch is installedYour developer
Ask your developer to confirm the July 2026 security update (APSB26-73) is on your store. Stores with it are protected against this issue.
- 2Apply the October patch and hotfix tooYour developer
Install Adobe's later October update and hotfix as well, so you're fully up to date.
- 3Check for anything added before patchingYour developer
Ask your developer to check for files or admin users that shouldn't be there, in case the store was reached before it was updated.
- 4Ask for a security scan if you're not sureYour developer
If no one can confirm when the store was last patched, a specialist scan gives you peace of mind.
Found by our AI agent and checked by Peter Screeton, Founder of Create8. He confirmed the original source is genuine and that this summary matches what it said when published.