Vulnerabilities · 218 days ago

Magento stores hit by WebRTC payment skimmer exploiting PolyShell

A WebRTC-based payment skimmer is exploiting the PolyShell vulnerability in Magento Open Source and Adobe Commerce to steal checkout payment data.

Timeline

• Mar 26 Reported by The Hacker News

Sources

1 source covering this story

• The Hacker News Mar 26

  WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites

  WebRTC skimmer exploits PolyShell flaw since March 19, hitting 56.7% stores, enabling stealth data theft bypassing CSP.

Part of the PlainSec briefing for 2026-03-27

Editions

• Briefing for 2026-03-27
• Briefing for 2026-03-26

Related stories

• Langflow code-injection flaw actively exploited after disclosure
• Unauthenticated RCE in Secure Firewall Management Center
• Immediate attacks target Oracle WebLogic RCE flaw