CTI · reviewed · 2026-09-30
Vulnerability in MyPresta Google Merchant Center Feed software
Actors
—
Malware / tools
—
Campaigns
—
CVEs
CVE-2026-85520
Victim sectors
e-commerce
Geography
—
MITRE ATT&CK
Indicators
No curated indicators tied to this case.
Detections
Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.
Sigma raw
title: MyPresta Google Merchant Center Feed PHP File Write
id: 6b1f4d0e-7a52-4c9b-9e3d-2f8a1c5b7d44
status: experimental
description: >
Detects unexpected PHP file creation under the PrestaShop Google
Merchant Center Feed (gmfeed) module directory or in web-reachable
upload paths, the on-disk artifact of CVE-2026-85520: an
unauthenticated request to the module's feed.php controls the
output file name, path, extension and content, so a successful
exploit drops attacker PHP inside the shop tree.
references:
- https://malware.news/t/vulnerability-in-mypresta-google-merchant-center-feed-software/125977#post_1
- https://mypresta.eu/news/google-merchant-center-security-fix-2026.html
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-88735
author: Tia N. List
date: 2026-09-30
tags:
- attack.t1190
- attack.t1505
logsource:
category: file_event
product: linux
detection:
selection_module_php:
TargetFilename|contains: '/modules/gmfeed/'
TargetFilename|endswith:
- '.php'
- '.phtml'
selection_upload_php:
TargetFilename|contains:
- '/upload/'
- '/uploads/'
- '/img/'
TargetFilename|endswith:
- '.php'
- '.phtml'
condition: selection_module_php or selection_upload_php
falsepositives:
- Legitimate installation or upgrade of the gmfeed module writing its own PHP files
- Another administrative upload that legitimately writes PHP into these directories
level: high