NewYour coding agent can read the release notes before it upgrades.Set up the MCP server →
Packagist · #3878 most downloaded on Packagist
Comprehensive defense-in-depth module that closes the PolyShell unrestricted file upload vulnerability (APSB25-94) in Adobe Commerce and Magento Open Source.
Last release 2 months ago
04 Aug 2026
Release timing varies
gaps range from 8 days to 3 months
Some releases are documented
notes for 6 of 11 stable releases
Nothing withdrawn
no release was ever pulled
5 months old
11 releases · first in 2026
One column per month.
Fix false positives on legit image uploads by @arnoudhgz in #19
Full Changelog: v1.3.4...v1.3.5
Fix #12 (follow-up): the v1.3.3 fix split the PHP payload string via concatenation but the explanatory comment still quoted the literal webshell signa
Fix #12 (follow-up): the v1.3.3 fix split the PHP payload string via concatenation but the explanatory comment still quoted the literal webshell signature verbatim, which Sansec eComscan's eval_post_91ce4 rule pattern-matches without context. The comment has been rewritten to describe the rationale without reproducing the signature.
Fix #12 : avoid eComscan false positive by obfuscating attack-simulation payloads in test fixtures.
Fix #12: avoid eComscan false positive by obfuscating attack-simulation payloads in test fixtures.
Nothing published for this version
Add .inc , .module , .phps to blocked extension patterns and BASE_BLOCKED_EXTENSIONS hash map
.inc, .module, .phps to blocked extension patterns and BASE_BLOCKED_EXTENSIONS hash mapfile.inc.png or file.module.gif passed BLOCKED_EXTENSION_PATTERNFixes #4
Support Magento Open Source (Community Edition) — skip test for Adobe Commerce-only class AbstractUploadFile when not present
AbstractUploadFile when not present (#2)composer.json for dependency resolutionNothing published for this version
Fully integrates markshust/magento2-module-polyshell-patch logic
Nothing published for this version
Nothing published for this version
Nothing published for this version
Your coding agent can read these notes before it upgrades. Set up the MCP server →