Security Hardening - Magento “PolyShell” File Upload Vulnerability Enhancements

Our engineering teams have completed the planned security enhancements and hardening efforts related to the Magento "PolyShell" unrestricted file upload vulnerability across our managed environment.

With these measures now fully implemented, we consider this incident resolved.

As security is a shared responsibility, we recommend that customers review their Magento installations, ensure all updates and patches are applied, and take additional steps to further secure their applications.

If you have any questions or require assistance, please reach out via chat or support case.

Our engineering teams have made significant progress in implementing additional security enhancements related to the Magento "PolyShell" unrestricted file upload vulnerability. At this stage, we are nearing completion of all planned mitigation efforts across our managed environment.

The measures deployed, including strengthened file upload validation, enhanced malware scanning to detect files, stricter execution controls, and broader platform hardening, have significantly reduced the risk of exploitation.

While these mitigations provide strong protection, security is a shared responsibility. We strongly encourage customers to review their Magento installations, ensure all updates and patches are applied, and follow general security best practices to help keep their sites secure.

If you have any questions or need assistance, please reach out to us through chat or via case.

We will provide further updates if any additional actions are required.

Following the actions taken to prohibit execution of files exploiting the Magento “PolyShell” unrestricted file upload vulnerability, our engineering teams are continuing to implement additional security enhancements across our managed environment.

These efforts include strengthening file upload validation and execution restrictions, enhancing monitoring and detection mechanisms, and implementing additional hardening measures across Magento platforms. We are also conducting internal reviews to reduce potential attack surfaces and reinforce overall platform security.

These proactive improvements reflect our ongoing commitment to maintaining a secure and resilient hosting environment. While the initial issue has been addressed, we are taking additional steps to further strengthen our systems and help prevent future risks.

While the additional measures that we have deployed should reduce the risk for potential compromise, we strongly urge that our customers take proactive measures to review and secure their sites

If you have any questions or concerns, please reach out to us through the following channels:
Live Chat: https://my.nexcess.net/
Email: support@nexcess.net

We will continue to share updates as these enhancements are completed.