magescan 0.4.0

Detections for the CVE-2026-75650 / APSB26-146 post-exploitation pattern (stolen integration token + CMS template-directive probing), plus Adobe Commerce Cloud log support.

New (12 rules, 31 → 43)

Database (magescan db)

• cms-block-template-directive-rce, cms-page-template-directive-rce — {{block … output=getModuleName}} and {{layout handle=…]|*[…}} code-exec probes; silent on normal {{widget}}/template= content
• integration-fullaccess-token-stale — full-access integration token >90 days old, never rotated
• oauth-token-orphan — token whose integration was deleted (can't be reauthorized from the admin)
• integration-bearer-enabled, admin-weak-security-config, payment-secret-plaintext, config-secret-oldest-key

Logs (magescan logs) — now reads Adobe Commerce Cloud /var/log/platform/*/access.log* (previously only nginx/apache paths, so Cloud exploit requests were missed)

• log-cmsblock-api-abuse — POST/PUT/DELETE bursts to /rest/V1/cmsBlock|cmsPage
• log-admin-token-bruteforce — hammering of /rest/V1/integration/admin/token
• log-exploit-tool-upload — python-requests upload probing / styles[generatorClass]; legit ERP python-requests traffic not matched

System (magescan system)

• php-in-php-tmpdir — PHP polyglots left in /tmp/<project> by rejected uploads

Run

curl -fsSL https://github.com/Genaker/magescan/releases/latest/download/magescan-linux-amd64 -o /tmp/magescan && chmod +x /tmp/magescan && /tmp/magescan all -root /var/www/magento -format table