Vulnerabilities & Exploits · Web App Attack

Magento stores hit by WebRTC payment skimmer exploiting PolyShell

A WebRTC-based payment skimmer is exploiting the PolyShell vulnerability in Magento Open Source and Adobe Commerce to steal checkout payment data.

1 source · Mar 26

Timeline

• Mar 26 Reported by The Hacker News

Sources

• Mar 26 The Hacker News

  WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites

  WebRTC skimmer exploits PolyShell flaw since March 19, hitting 56.7% stores, enabling stealth data theft bypassing CSP.

  original

Part of the PlainSec briefing for 2026-03-27

Every edition of this story: Magento stores hit by WebRTC payment skimmer exploiting PolyShell

More from today

• Langflow code-injection flaw actively exploited after disclosure
• Unauthenticated RCE in Secure Firewall Management Center
• Immediate attacks target Oracle WebLogic RCE flaw