Sansec BV
@sans.ec
experts in eCommerce security - https://sansec.io
Adobe will release fix for the critical SessionReaper attack tomorrow Sept 9th. All Magento and Adobe Commerce versions are vulnerable.
Sansec Shield users are already protected, all others should standby and implement patch once it is published (likely 14h UTC).
sansec.io/research/ses...
Sansec Shield users are already protected, all others should standby and implement patch once it is published (likely 14h UTC).
sansec.io/research/ses...
SessionReaper, a critical bug in Magento & Adobe Commerce (CVE-2025-54236)
Adobe breaks their regular patch schedule and will release an emergency fix for CVE-2025-54236 within the next 24 hours. Automated abuse is expected and merc...
sansec.io
September 8, 2025 at 1:26 PM
Adobe will release fix for the critical SessionReaper attack tomorrow Sept 9th. All Magento and Adobe Commerce versions are vulnerable.
Sansec Shield users are already protected, all others should standby and implement patch once it is published (likely 14h UTC).
sansec.io/research/ses...
Sansec Shield users are already protected, all others should standby and implement patch once it is published (likely 14h UTC).
sansec.io/research/ses...
Reposted by Sansec BV
A supply chain attack involving 21 backdoored Magento extensions has compromised between 500 and 1,000 e-commerce stores, including one belonging to a $40 billion multinational.
Magento supply chain attack compromises hundreds of e-stores
A supply chain attack involving 21 backdoored Magento extensions has compromised between 500 and 1,000 e-commerce stores, including one belonging to a $40 billion multinational.
www.bleepingcomputer.com
May 2, 2025 at 6:10 PM
A supply chain attack involving 21 backdoored Magento extensions has compromised between 500 and 1,000 e-commerce stores, including one belonging to a $40 billion multinational.
Coordinated supply chain attack hits 3 vendors, backdoors go unnoticed for 6 years. Sansec discovered actual abuse has started last week.
sansec.io/research/lic...
sansec.io/research/lic...
Backdoor found in popular ecommerce components
Multiple vendors were hacked in a coordinated supply chain attack, Sansec found 21 applications with the same backdoor. Curiously, the malware was injected 6...
sansec.io
May 2, 2025 at 2:43 PM
Coordinated supply chain attack hits 3 vendors, backdoors go unnoticed for 6 years. Sansec discovered actual abuse has started last week.
sansec.io/research/lic...
sansec.io/research/lic...
⚽️🔥 AS Roma has been hacked since March 19. Attack is ongoing, and customer data is leaked to the Russian SmartApe network (AS62212).
We reached out 5 times to their privacy & security teams but no response.
We reached out 5 times to their privacy & security teams but no response.
April 18, 2025 at 12:02 PM
⚽️🔥 AS Roma has been hacked since March 19. Attack is ongoing, and customer data is leaked to the Russian SmartApe network (AS62212).
We reached out 5 times to their privacy & security teams but no response.
We reached out 5 times to their privacy & security teams but no response.
Found "defunct.dat" or "qfile" on your site? They contain access keys for hidden GSocket backdoors. Mass scans for these files launched since Mar 31st. Dozens of sites affected.
sansec.io/research/gso...
sansec.io/research/gso...
April 3, 2025 at 2:33 PM
Found "defunct.dat" or "qfile" on your site? They contain access keys for hidden GSocket backdoors. Mass scans for these files launched since Mar 31st. Dozens of sites affected.
sansec.io/research/gso...
sansec.io/research/gso...
Worried about having to roll out ABSP25-08 before the weekend? No stress! 🚀 Meet Sansec Shield (beta)—an origin-bound WAF built to guard your store against all major Magento attack vectors, including this week's CVSS 9.4 threat.
Installation is just a composer require.
sansec.io/guides/sanse...
Installation is just a composer require.
sansec.io/guides/sanse...
Sansec Shield (Beta)
Advanced real-time protection for your Magento store
sansec.io
February 13, 2025 at 1:53 PM
Worried about having to roll out ABSP25-08 before the weekend? No stress! 🚀 Meet Sansec Shield (beta)—an origin-bound WAF built to guard your store against all major Magento attack vectors, including this week's CVSS 9.4 threat.
Installation is just a composer require.
sansec.io/guides/sanse...
Installation is just a composer require.
sansec.io/guides/sanse...
Impact analysis for Adobe Commerce & Magento security release APSB25-08: unauthorized attackers can take control of your customer accounts. Not as critical as CosmicSting but still recommended to patch asap.
Full analysis: sansec.io/research/mag...
Full analysis: sansec.io/research/mag...
Magento Security Release APSB25-08 [Impact Analysis]
Critical (CVSS 9.4) release enables attackers to take control of customer accounts.
sansec.io
February 13, 2025 at 8:48 AM
Impact analysis for Adobe Commerce & Magento security release APSB25-08: unauthorized attackers can take control of your customer accounts. Not as critical as CosmicSting but still recommended to patch asap.
Full analysis: sansec.io/research/mag...
Full analysis: sansec.io/research/mag...
"Foreign espionage campaign launched via Christmas sweaters"
The 🚀 ESA (European Space Agency) store just got hacked.
The store seems to be integrated with ESA systems, as employees are required to login with their ESA email address.
The 🚀 ESA (European Space Agency) store just got hacked.
The store seems to be integrated with ESA systems, as employees are required to login with their ESA email address.
December 23, 2024 at 2:58 PM
"Foreign espionage campaign launched via Christmas sweaters"
The 🚀 ESA (European Space Agency) store just got hacked.
The store seems to be integrated with ESA systems, as employees are required to login with their ESA email address.
The 🚀 ESA (European Space Agency) store just got hacked.
The store seems to be integrated with ESA systems, as employees are required to login with their ESA email address.
Welcome to our new humble presence! To commemorate, we have just released eComscan 1.7.0 with more detailed malware reporting and tons of improvements. Your version will auto upgrade.
sansec.io/guides/chang...
sansec.io/guides/chang...
November 19, 2024 at 3:42 PM
Welcome to our new humble presence! To commemorate, we have just released eComscan 1.7.0 with more detailed malware reporting and tons of improvements. Your version will auto upgrade.
sansec.io/guides/chang...
sansec.io/guides/chang...