🚨 BlockStrap (Magento / Adobe Commerce, CVSS 10.0)

We've reproduced several RCE chains and expect threat actors to follow suit imminently.

If you haven't patched yet, we strongly urge you to do so now.

sansec.io/research/block…

🚨 We discovered StyleSmuggler, an unauthenticated RCE in Magento & Adobe Commerce under active exploitation. Confirmed on clean 2.4.7, 2.4.8 and 2.4.9 installs. PHP executes during failed payment email rendering.

Our research: sansec.io/research/style…

Critical FunnelKit vulnerability threatens 40,000+ WooCommerce checkouts. We're already seeing exploitation in the wild.
sansec.io/research/funne…

🚨 New Adobe Commerce flaw (CVE-2025-54236, CVSS 9.1) under active attack.

Over 250 exploit attempts in 24 hours—mostly on unpatched Magento sites.

PoC is public. Patch now.

Details → thehackernews.com/2025/10/over-2…

@sansecio Over 250 attacks hit #Adobe #Commerce and #Magento via critical CVE-2025-54236 flaw
securityaffairs.com/183754/hacking…
#securityaffairs #hacking

Critical Adobe Commerce, Magento vulnerability under attack (CVE-2025-54236) - helpnetsecurity.com/2025/10/23/ado… - @Adobe @assetnote @SLCyberSec @sansecio #Ecommerce #Vulnerability #Cybersecurity #CybersecurityNews

🚨 SessionReaper (CVE-2025-54236) is now actively exploited while 62% of Adobe Commerce/Magento stores remain unpatched. We expect automated mass attacks within 48 hours. sansec.io/research/sessi…

Exceptionnally back on X for that. If you are a Magento or Adobe Commerce user, patch as soon as possible - the patch of my bug will be released imminently.
This has one of the most severe impact possible, and is easy to trigger. Expect attacks, very soon.
#magento #ecommerce

Urgent: Adobe will drop critical patch tomorrow, outside of regular patch cycle. Fixes SessionReaper attack, affects Adobe Commerce / Magento 2.3.1+. Concept patch accidentally leaked.

sansec.io/research/sessi…

3000 stores just got hit with the "statepulseapp[.]com" skimmer, injected by Group Laski. Sansec is the only vendor that recognises it:
virustotal.com/gui/domain/sta…

Just published a new @integer_net module: Sansec Watch integration for Magento 2

github.com/integer-net/ma…

Our research was covered by @lorenzofb of @TechCrunch @ techcrunch.com/2024/10/22/res…

Our whole investigation started after @sansecio & @gwillem reported on the polyfill[.]io supply chain compromise. A company called "FUNNULL" out of China were behind it. But wait, we know them?? 👀

😬 More than 2000 Magento stores hacked by Peschanki group in the last 20 hours and they're not slowing down.

☞ largest automated hack of Magento stores ever
☞ 6.8% of all Adobe Commerce / Magento stores worldwide hacked via CosmicSting exploit

🚨 The number of hacked stores in this campaign surpassed 1,000 overnight, with no sign of slowing down.

Beware: Group Peschanki hacks over 350 new stores in the last 5 hours #cosmicsting #magento
sansec.io/research/cosmi…

Say hi to Laski, the 8th CosmicSting attack group, using fake maintenance pages on deslgnhq[.]com and others.

Fun fact: their infra went down several times, likely because they couldn't keep up with the high traffic hijacked stores.

IOCs here sansec.io/research/cosmi…

Solid activity in our threat intel repo. Still no match for the incredible @500mk500 though, that guy is killing it

Sansec is proud sponsor of Ecommerce Camp Birmingham at Oct 24th!
ecommercecamp.co.uk/ecommerce-camp…

Server with #opendir 213.109.147[.]108:4242 (now disabled) had an exploit for #CosmicSting (aka CVE-2024-34102), an Unauthorized XXE that combined with CVE-2024-2961 allows RCE in Magento and Adobe Commerce stores.

On the server there was a TXT file with about 3900 domains. Expected database theft, malicious script injection and/or malware distribution among other things.

More info about this threat by @sansecio : sansec.io/research/cosmi…

Magento patch day! helpx.adobe.com/security/produ… with a RCE by me, start updating guys!