New ‘PolyShell’ flaw allows unauthenticated RCE on Magento e-stores

A critical vulnerability named "PolyShell" affects Magento Open Source and Adobe Commerce v2 installations by allowing unauthenticated file uploads via the REST API custom options feature; crafted polyglot files can act as images and scripts enabling RCE or stored XSS/account takeover depending on webserver configuration. Adobe provided a fix only in an alpha release (2.4.9 alpha), exploit methods are reported to be circulating though no active exploitation has been observed yet, and immediate mitigations include restricting access to pub/media/custom_options/* and scanning for uploaded shells.