Sansec

Experts in ecommerce security. Helping merchants in times of peril. Tracking large scale digital skimming since 2015. PGP key 9D0D094CD2C7E669

[Sansec @sansecio]

Critical FunnelKit vulnerability threatens 40,000+ WooCommerce checkouts. We're already seeing exploitation in the wild.
https://t.co/0StWJ9m6pf

[The Hacker News @TheHackersNews]

🚨 New Adobe Commerce flaw (CVE-2025-54236, CVSS 9.1) under active attack.

Over 250 exploit attempts in 24 hours—mostly on unpatched Magento sites.

PoC is public. Patch now.

Details → https://t.co/cNYlLIs9xA

[Pierluigi Paganini - Security Affairs @securityaffairs]

@sansecio Over 250 attacks hit #Adobe #Commerce and #Magento via critical CVE-2025-54236 flaw
https://t.co/2hPBs7AlSg
#securityaffairs #hacking

[Help Net Security @helpnetsecurity]

Critical Adobe Commerce, Magento vulnerability under attack (CVE-2025-54236) - https://t.co/RNArR1SEk4 - @Adobe @assetnote @SLCyberSec @sansecio #Ecommerce #Vulnerability #Cybersecurity #CybersecurityNews

[Sansec @sansecio]

🚨 SessionReaper (CVE-2025-54236) is now actively exploited while 62% of Adobe Commerce/Magento stores remain unpatched. We expect automated mass attacks within 48 hours. https://t.co/Po4qMTgAb6

[Blaklis @Blaklis_]

Exceptionnally back on X for that. If you are a Magento or Adobe Commerce user, patch as soon as possible - the patch of my bug will be released imminently.
This has one of the most severe impact possible, and is easy to trigger. Expect attacks, very soon.
#magento #ecommerce

[Sansec @sansecio]

Urgent: Adobe will drop critical patch tomorrow, outside of regular patch cycle. Fixes SessionReaper attack, affects Adobe Commerce / Magento 2.3.1+. Concept patch accidentally leaked.

https://t.co/Yh8yL4e3s5

[Sansec @sansecio]

3000 stores just got hit with the "statepulseapp[.]com" skimmer, injected by Group Laski. Sansec is the only vendor that recognises it:
https://t.co/0ig9zQ79Qa

[renttek @Renttek92]

Just published a new @integer_net module: Sansec Watch integration for Magento 2

https://t.co/QwbNgqSRLF

[Zach Edwards @thezedwards]

Our research was covered by @lorenzofb of @TechCrunch @ https://t.co/hhCqXTSOTD

Our whole investigation started after @sansecio & @gwillem reported on the polyfill[.]io supply chain compromise. A company called "FUNNULL" out of China were behind it. But wait, we know them?? 👀

[Sansec @sansecio]

😬 More than 2000 Magento stores hacked by Peschanki group in the last 20 hours and they're not slowing down.

☞ largest automated hack of Magento stores ever
☞ 6.8% of all Adobe Commerce / Magento stores worldwide hacked via CosmicSting exploit

[Sansec @sansecio]

Beware: Group Peschanki hacks over 350 new stores in the last 5 hours #cosmicsting #magento
https://t.co/TqR6ng34d0

[Sansec @sansecio]

🚨 The number of hacked stores in this campaign surpassed 1,000 overnight, with no sign of slowing down.

[Sansec @sansecio]

Beware: Group Peschanki hacks over 350 new stores in the last 5 hours #cosmicsting #magento
https://t.co/TqR6ng34d0

[Sansec @sansecio]

Beware: Group Peschanki hacks over 350 new stores in the last 5 hours #cosmicsting #magento
https://t.co/TqR6ng34d0

[Sansec @sansecio]

Say hi to Laski, the 8th CosmicSting attack group, using fake maintenance pages on deslgnhq[.]com and others.

Fun fact: their infra went down several times, likely because they couldn't keep up with the high traffic hijacked stores.

IOCs here https://t.co/6V0946nzRy

[Sansec @sansecio]

Solid activity in our threat intel repo. Still no match for the incredible @500mk500 though, that guy is killing it

[Sansec @sansecio]

Sansec is proud sponsor of Ecommerce Camp Birmingham at Oct 24th!
https://t.co/hqE64hEYT8

[Germán Fernández @1ZRR4H]

Server with #opendir 213.109.147[.]108:4242 (now disabled) had an exploit for #CosmicSting (aka CVE-2024-34102), an Unauthorized XXE that combined with CVE-2024-2961 allows RCE in Magento and Adobe Commerce stores.

On the server there was a TXT file with about 3900 vulnerable/compromised domains. Expected database theft, malicious script injection and/or malware distribution among other things.

More info about this threat by @sansecio : https://t.co/ZuTXm1PegE

[Teun Lassche @teunlassche]

Magento patch day! https://t.co/D68X4ktB6z with a RCE by me, start updating guys!

[Sansec @sansecio]

@Furan917 Thanks Francis 🙌 we have updated the article.

[Sansec @sansecio]

🚨 CosmicSting attacks have started hitting major stores, with 3 to 5 stores being hacked every hour. Merchants might still be at risk despite patching. We cover some additional mitigation steps 👉
https://t.co/kt9jFyfyMt