Adobe will release fix for the critical SessionReaper attack tomorrow Sept 9th. All Magento and Adobe Commerce versions are vulnerable. Sansec Shield users are already protected, all others should standby and implement patch once it is published (likely 14h UTC). sansec.io/research/ses...

SessionReaper, a critical bug in Magento & Adobe Commerce (CVE-2025-54236)

Adobe breaks their regular patch schedule and will release an emergency fix for CVE-2025-54236 within the next 24 hours. Automated abuse is expected and merc...

sansec.io

A supply chain attack involving 21 backdoored Magento extensions has compromised between 500 and 1,000 e-commerce stores, including one belonging to a $40 billion multinational.

Magento supply chain attack compromises hundreds of e-stores

A supply chain attack involving 21 backdoored Magento extensions has compromised between 500 and 1,000 e-commerce stores, including one belonging to a $40 billion multinational.

bleepingcomputer.com

Coordinated supply chain attack hits 3 vendors, backdoors go unnoticed for 6 years. Sansec discovered actual abuse has started last week. sansec.io/research/lic...

Backdoor found in popular ecommerce components

Multiple vendors were hacked in a coordinated supply chain attack, Sansec found 21 applications with the same backdoor. Curiously, the malware was injected 6...

sansec.io

⚽️🔥 AS Roma has been hacked since March 19. Attack is ongoing, and customer data is leaked to the Russian SmartApe network (AS62212). We reached out 5 times to their privacy & security teams but no response.

Found "defunct.dat" or "qfile" on your site? They contain access keys for hidden GSocket backdoors. Mass scans for these files launched since Mar 31st. Dozens of sites affected. sansec.io/research/gso...

Worried about having to roll out ABSP25-08 before the weekend? No stress! 🚀 Meet Sansec Shield (beta)—an origin-bound WAF built to guard your store against all major Magento attack vectors, including this week's CVSS 9.4 threat. Installation is just a composer require. sansec.io/guides/sanse...

Sansec Shield (Beta)

Advanced real-time protection for your Magento store

sansec.io

Impact analysis for Adobe Commerce & Magento security release APSB25-08: unauthorized attackers can take control of your customer accounts. Not as critical as CosmicSting but still recommended to patch asap. Full analysis: sansec.io/research/mag...

Magento Security Release APSB25-08 [Impact Analysis]

Critical (CVSS 9.4) release enables attackers to take control of customer accounts.

sansec.io

"Foreign espionage campaign launched via Christmas sweaters" The 🚀 ESA (European Space Agency) store just got hacked. The store seems to be integrated with ESA systems, as employees are required to login with their ESA email address.

Welcome to our new humble presence! To commemorate, we have just released eComscan 1.7.0 with more detailed malware reporting and tons of improvements. Your version will auto upgrade. sansec.io/guides/chang...