#adobecommerce — Public Fediverse posts
Live and recent posts from across the Fediverse tagged #adobecommerce, aggregated by home.social.
-
Adobe Commerce is making MariaDB its default database platform as MySQL
support ends. Discover what this means for Magento users and future workloads. https://mariadb.org/adobe-commerce-chooses-mariadb-as-its-default-database-platform/Welcome to MariaDB! 🦭 #mariadb #magento #adobeCommerce
-
Adobe Commerce is making MariaDB its default database platform as MySQL
support ends. Discover what this means for Magento users and future workloads. https://mariadb.org/adobe-commerce-chooses-mariadb-as-its-default-database-platform/Welcome to MariaDB! 🦭 #mariadb #magento #adobeCommerce
-
Adobe Commerce is making MariaDB its default database platform as MySQL
support ends. Discover what this means for Magento users and future workloads. https://mariadb.org/adobe-commerce-chooses-mariadb-as-its-default-database-platform/Welcome to MariaDB! 🦭 #mariadb #magento #adobeCommerce
-
Adobe Commerce is making MariaDB its default database platform as MySQL
support ends. Discover what this means for Magento users and future workloads. https://mariadb.org/adobe-commerce-chooses-mariadb-as-its-default-database-platform/Welcome to MariaDB! 🦭 #mariadb #magento #adobeCommerce
-
Adobe Commerce is making MariaDB its default database platform as MySQL
support ends. Discover what this means for Magento users and future workloads. https://mariadb.org/adobe-commerce-chooses-mariadb-as-its-default-database-platform/Welcome to MariaDB! 🦭 #mariadb #magento #adobeCommerce
-
We’re sponsoring Meet Magento Germany on Oct 22, 2026 in Mainz, Germany. Come meet our founder @naderman to talk software supply chain security and answer your questions.
Tickets available, CFP open: https://de.meet-magento.com/
-
We’re sponsoring Meet Magento Germany on Oct 22, 2026 in Mainz, Germany. Come meet our founder @naderman to talk software supply chain security and answer your questions.
Tickets available, CFP open: https://de.meet-magento.com/
-
We’re sponsoring Meet Magento Germany on Oct 22, 2026 in Mainz, Germany. Come meet our founder @naderman to talk software supply chain security and answer your questions.
Tickets available, CFP open: https://de.meet-magento.com/
-
We’re sponsoring Meet Magento Germany on Oct 22, 2026 in Mainz, Germany. Come meet our founder @naderman to talk software supply chain security and answer your questions.
Tickets available, CFP open: https://de.meet-magento.com/
-
We’re sponsoring Meet Magento Germany on Oct 22, 2026 in Mainz, Germany. Come meet our founder @naderman to talk software supply chain security and answer your questions.
Tickets available, CFP open: https://de.meet-magento.com/
-
How to Choose the Right Adobe Gold Solution Partner
Choosing the right partner for Adobe Commerce is a strategic decision. Enterprise eCommerce systems are complex. A weak implementation creates technical debt over time. A strong implementation builds stability and supports growth.
To know more, read our blog: https://www.ziffity.com/blog/top-adobe-commerce-gold-partners-in-the-united-states/
-
Vulnerability in REST API allows attackers to upload executable files.
Unrestricted file upload: all #Magento #OpenSource and #AdobeCommerce versions up to 2.4.9-alpha2
#XSS: all versions pre-2.3.5 or custom webserver config
#RCE via #PHP upload: #nginx 2.0.0–2.2.x (via index.php filename), any non-stock version nginx passing all .php to fastcgi, #Apache pre-2.3.5 without php_flag engine 0
Patched: 2.4.9-alpha3+ (pre-release only)
-
Vulnerability in REST API allows attackers to upload executable files.
Unrestricted file upload: all #Magento #OpenSource and #AdobeCommerce versions up to 2.4.9-alpha2
#XSS: all versions pre-2.3.5 or custom webserver config
#RCE via #PHP upload: #nginx 2.0.0–2.2.x (via index.php filename), any non-stock version nginx passing all .php to fastcgi, #Apache pre-2.3.5 without php_flag engine 0
Patched: 2.4.9-alpha3+ (pre-release only)
-
Vulnerability in REST API allows attackers to upload executable files.
Unrestricted file upload: all #Magento #OpenSource and #AdobeCommerce versions up to 2.4.9-alpha2
#XSS: all versions pre-2.3.5 or custom webserver config
#RCE via #PHP upload: #nginx 2.0.0–2.2.x (via index.php filename), any non-stock version nginx passing all .php to fastcgi, #Apache pre-2.3.5 without php_flag engine 0
Patched: 2.4.9-alpha3+ (pre-release only)
-
Vulnerability in REST API allows attackers to upload executable files.
Unrestricted file upload: all #Magento #OpenSource and #AdobeCommerce versions up to 2.4.9-alpha2
#XSS: all versions pre-2.3.5 or custom webserver config
#RCE via #PHP upload: #nginx 2.0.0–2.2.x (via index.php filename), any non-stock version nginx passing all .php to fastcgi, #Apache pre-2.3.5 without php_flag engine 0
Patched: 2.4.9-alpha3+ (pre-release only)
-
Vulnerability in REST API allows attackers to upload executable files.
Unrestricted file upload: all #Magento #OpenSource and #AdobeCommerce versions up to 2.4.9-alpha2
#XSS: all versions pre-2.3.5 or custom webserver config
#RCE via #PHP upload: #nginx 2.0.0–2.2.x (via index.php filename), any non-stock version nginx passing all .php to fastcgi, #Apache pre-2.3.5 without php_flag engine 0
Patched: 2.4.9-alpha3+ (pre-release only)
-
#Adobe-#Patchday: Schadcodeschmuggel in Reader, Illustrator und weiteren möglich | Security https://www.heise.de/news/Adobe-Patchday-Schadcodeschmuggel-in-Reader-Illustrator-und-weiteren-moeglich-11206633.html #CrossSiteScripting #XSS #MagentoOpenSource #AdobeCommerce
-
#Adobe-#Patchday: Schadcodeschmuggel in Reader, Illustrator und weiteren möglich | Security https://www.heise.de/news/Adobe-Patchday-Schadcodeschmuggel-in-Reader-Illustrator-und-weiteren-moeglich-11206633.html #CrossSiteScripting #XSS #MagentoOpenSource #AdobeCommerce
-
#Adobe-#Patchday: Schadcodeschmuggel in Reader, Illustrator und weiteren möglich | Security https://www.heise.de/news/Adobe-Patchday-Schadcodeschmuggel-in-Reader-Illustrator-und-weiteren-moeglich-11206633.html #CrossSiteScripting #XSS #MagentoOpenSource #AdobeCommerce
-
#Adobe-#Patchday: Schadcodeschmuggel in Reader, Illustrator und weiteren möglich | Security https://www.heise.de/news/Adobe-Patchday-Schadcodeschmuggel-in-Reader-Illustrator-und-weiteren-moeglich-11206633.html #CrossSiteScripting #XSS #MagentoOpenSource #AdobeCommerce
-
HOW TO APPROACH ADOBE COMMERCE 2.4.9 SAFELY
Plan your Adobe Commerce 2.4.9 upgrade the right way. Talk to our experts today and secure a smooth, risk-free release.
Pickour team: https://www.ziffity.com/adobe-commerce/#AdobeCommerce #Magento #MagentoUpgrade #eCommerceDevelopment
-
Angreifer attackieren kritische Lücke in #AdobeCommerce und #Magento | Security https://www.heise.de/news/Angreifer-attackieren-kritische-Luecke-in-Adobe-Commerce-und-Magento-10845752.html #SessionReaper #Adobe #AdobeMagento #Patchday
-
Angreifer attackieren kritische Lücke in #AdobeCommerce und #Magento | Security https://www.heise.de/news/Angreifer-attackieren-kritische-Luecke-in-Adobe-Commerce-und-Magento-10845752.html #SessionReaper #Adobe #AdobeMagento #Patchday
-
Angreifer attackieren kritische Lücke in #AdobeCommerce und #Magento | Security https://www.heise.de/news/Angreifer-attackieren-kritische-Luecke-in-Adobe-Commerce-und-Magento-10845752.html #SessionReaper #Adobe #AdobeMagento #Patchday
-
Angreifer attackieren kritische Lücke in #AdobeCommerce und #Magento | Security https://www.heise.de/news/Angreifer-attackieren-kritische-Luecke-in-Adobe-Commerce-und-Magento-10845752.html #SessionReaper #Adobe #AdobeMagento #Patchday
-
SessionReaper Exploits Erupt as Magento Sites Lag on Patching https://thecyberexpress.com/sessionreaper-exploits-erupt/ #SessionReaperExploitation #ExploitedVulnerabilities #VulnerabilitiesPatching #ThreatIntelligence #VulnerabilityNews #Vulnerabilities #CyberEssentials #FirewallDaily #AdobeCommerce #SessionReaper #CyberNews #Magento
-
SessionReaper Exploits Erupt as Magento Sites Lag on Patching https://thecyberexpress.com/sessionreaper-exploits-erupt/ #SessionReaperExploitation #ExploitedVulnerabilities #VulnerabilitiesPatching #ThreatIntelligence #VulnerabilityNews #Vulnerabilities #CyberEssentials #FirewallDaily #AdobeCommerce #SessionReaper #CyberNews #Magento
-
SessionReaper Exploits Erupt as Magento Sites Lag on Patching https://thecyberexpress.com/sessionreaper-exploits-erupt/ #SessionReaperExploitation #ExploitedVulnerabilities #VulnerabilitiesPatching #ThreatIntelligence #VulnerabilityNews #Vulnerabilities #CyberEssentials #FirewallDaily #AdobeCommerce #SessionReaper #CyberNews #Magento
-
SessionReaper Exploits Erupt as Magento Sites Lag on Patching https://thecyberexpress.com/sessionreaper-exploits-erupt/ #SessionReaperExploitation #ExploitedVulnerabilities #VulnerabilitiesPatching #ThreatIntelligence #VulnerabilityNews #Vulnerabilities #CyberEssentials #FirewallDaily #AdobeCommerce #SessionReaper #CyberNews #Magento
-
🚨 CRITICAL: CVE-2025-54236 'SessionReaper' in Adobe Commerce lets remote attackers hijack user sessions without authentication. No active exploits, but EU e-commerce at risk. Enforce strict session controls, monitor activity, prep for patch. https://radar.offseq.com/threat/fear-the-sessionreaper-adobe-commerce-flaw-under-a-4ca43c60 #OffSeq #AdobeCommerce #vuln
-
🚨 CRITICAL: CVE-2025-54236 'SessionReaper' in Adobe Commerce lets remote attackers hijack user sessions without authentication. No active exploits, but EU e-commerce at risk. Enforce strict session controls, monitor activity, prep for patch. https://radar.offseq.com/threat/fear-the-sessionreaper-adobe-commerce-flaw-under-a-4ca43c60 #OffSeq #AdobeCommerce #vuln
-
🚨 CRITICAL: CVE-2025-54236 'SessionReaper' in Adobe Commerce lets remote attackers hijack user sessions without authentication. No active exploits, but EU e-commerce at risk. Enforce strict session controls, monitor activity, prep for patch. https://radar.offseq.com/threat/fear-the-sessionreaper-adobe-commerce-flaw-under-a-4ca43c60 #OffSeq #AdobeCommerce #vuln
-
Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk https://www.securityweek.com/exploitation-of-critical-adobe-commerce-flaw-puts-many-ecommerce-sites-at-risk/ #Vulnerabilities #AdobeCommerce #exploited #magento
-
Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk https://www.securityweek.com/exploitation-of-critical-adobe-commerce-flaw-puts-many-ecommerce-sites-at-risk/ #Vulnerabilities #AdobeCommerce #exploited #magento
-
Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk https://www.securityweek.com/exploitation-of-critical-adobe-commerce-flaw-puts-many-ecommerce-sites-at-risk/ #Vulnerabilities #AdobeCommerce #exploited #magento
-
Exploitation of Critical Adobe Commerce Flaw Puts Many eCommerce Sites at Risk https://www.securityweek.com/exploitation-of-critical-adobe-commerce-flaw-puts-many-ecommerce-sites-at-risk/ #Vulnerabilities #AdobeCommerce #exploited #magento
-
🔥 SessionReaper (CVE-2025-54236) exploited in wild! 250+ Magento stores hit via Adobe Commerce REST API flaw—unauth RCE, webshells, account takeover. 62% still unpatched. Patch ASAP, audit uploads, monitor logs. https://radar.offseq.com/threat/over-250-magento-stores-hit-overnight-as-hackers-e-c68791e2 #OffSeq #Magento #AdobeCommerce #Infosec
-
🔥 SessionReaper (CVE-2025-54236) exploited in wild! 250+ Magento stores hit via Adobe Commerce REST API flaw—unauth RCE, webshells, account takeover. 62% still unpatched. Patch ASAP, audit uploads, monitor logs. https://radar.offseq.com/threat/over-250-magento-stores-hit-overnight-as-hackers-e-c68791e2 #OffSeq #Magento #AdobeCommerce #Infosec
-
🔥 SessionReaper (CVE-2025-54236) exploited in wild! 250+ Magento stores hit via Adobe Commerce REST API flaw—unauth RCE, webshells, account takeover. 62% still unpatched. Patch ASAP, audit uploads, monitor logs. https://radar.offseq.com/threat/over-250-magento-stores-hit-overnight-as-hackers-e-c68791e2 #OffSeq #Magento #AdobeCommerce #Infosec
-
🔥 SessionReaper (CVE-2025-54236) exploited in wild! 250+ Magento stores hit via Adobe Commerce REST API flaw—unauth RCE, webshells, account takeover. 62% still unpatched. Patch ASAP, audit uploads, monitor logs. https://radar.offseq.com/threat/over-250-magento-stores-hit-overnight-as-hackers-e-c68791e2 #OffSeq #Magento #AdobeCommerce #Infosec
-
🔥 SessionReaper (CVE-2025-54236) exploited in wild! 250+ Magento stores hit via Adobe Commerce REST API flaw—unauth RCE, webshells, account takeover. 62% still unpatched. Patch ASAP, audit uploads, monitor logs. https://radar.offseq.com/threat/over-250-magento-stores-hit-overnight-as-hackers-e-c68791e2 #OffSeq #Magento #AdobeCommerce #Infosec
-
A dangerous flaw in Adobe Commerce lets hackers hijack customer sessions with zero effort—and 60% of Magento stores are still unpatched. Is your business vulnerable?
#sessionreaper
#adobecommerce
#magento
#cve202554236
#ecommercesecurity -
A dangerous flaw in Adobe Commerce lets hackers hijack customer sessions with zero effort—and 60% of Magento stores are still unpatched. Is your business vulnerable?
#sessionreaper
#adobecommerce
#magento
#cve202554236
#ecommercesecurity -
A dangerous flaw in Adobe Commerce lets hackers hijack customer sessions with zero effort—and 60% of Magento stores are still unpatched. Is your business vulnerable?
#sessionreaper
#adobecommerce
#magento
#cve202554236
#ecommercesecurity -
A dangerous flaw in Adobe Commerce lets hackers hijack customer sessions with zero effort—and 60% of Magento stores are still unpatched. Is your business vulnerable?
#sessionreaper
#adobecommerce
#magento
#cve202554236
#ecommercesecurity -
A dangerous flaw in Adobe Commerce lets hackers hijack customer sessions with zero effort—and 60% of Magento stores are still unpatched. Is your business vulnerable?
#sessionreaper
#adobecommerce
#magento
#cve202554236
#ecommercesecurity -
🚨 Critical Magento & Adobe Commerce Flaw (CVE-2025-54236 – SessionReaper) 🚨
Impact: Customer account takeover + unauthenticated remote code execution (CVSS 9.1 Critical).
👉 Full details and action steps: https://hostvix.com/sessionreaper-critical-magento-adobe-commerce-vulnerability-cve-2025-54236/
#Magento #AdobeCommerce #SessionReaper #CVE202554236 #CVE #Infosec #CyberSecurity #AppSec #WebSecurity #SecOps #BlueTeam #RedTeam #ThreatIntel #Vulnerability #PatchNow #ZeroDay #Exploit #EcommerceSecurity #DataSecurity #SecurityUpdate
-
🚨 Critical Magento & Adobe Commerce Flaw (CVE-2025-54236 – SessionReaper) 🚨
Impact: Customer account takeover + unauthenticated remote code execution (CVSS 9.1 Critical).
👉 Full details and action steps: https://hostvix.com/sessionreaper-critical-magento-adobe-commerce-vulnerability-cve-2025-54236/
#Magento #AdobeCommerce #SessionReaper #CVE202554236 #CVE #Infosec #CyberSecurity #AppSec #WebSecurity #SecOps #BlueTeam #RedTeam #ThreatIntel #Vulnerability #PatchNow #ZeroDay #Exploit #EcommerceSecurity #DataSecurity #SecurityUpdate
-
🚨 Critical Magento & Adobe Commerce Flaw (CVE-2025-54236 – SessionReaper) 🚨
Impact: Customer account takeover + unauthenticated remote code execution (CVSS 9.1 Critical).
👉 Full details and action steps: https://hostvix.com/sessionreaper-critical-magento-adobe-commerce-vulnerability-cve-2025-54236/
#Magento #AdobeCommerce #SessionReaper #CVE202554236 #CVE #Infosec #CyberSecurity #AppSec #WebSecurity #SecOps #BlueTeam #RedTeam #ThreatIntel #Vulnerability #PatchNow #ZeroDay #Exploit #EcommerceSecurity #DataSecurity #SecurityUpdate
-
🚨 Critical Magento & Adobe Commerce Flaw (CVE-2025-54236 – SessionReaper) 🚨
Impact: Customer account takeover + unauthenticated remote code execution (CVSS 9.1 Critical).
👉 Full details and action steps: https://hostvix.com/sessionreaper-critical-magento-adobe-commerce-vulnerability-cve-2025-54236/
#Magento #AdobeCommerce #SessionReaper #CVE202554236 #CVE #Infosec #CyberSecurity #AppSec #WebSecurity #SecOps #BlueTeam #RedTeam #ThreatIntel #Vulnerability #PatchNow #ZeroDay #Exploit #EcommerceSecurity #DataSecurity #SecurityUpdate
-
Adobe Issues Urgent Patch for ‘SessionReaper’ Vulnerability in Commerce and Magento https://thecyberexpress.com/adobe-commerce-flaw-cve-2025-54236/ #TheCyberExpressNews #Vulnerabilities #TheCyberExpress #FirewallDaily #AdobeCommerce #SessionReaper #CVE202554236 #CyberNews #Magento
-
Adobe Issues Urgent Patch for ‘SessionReaper’ Vulnerability in Commerce and Magento https://thecyberexpress.com/adobe-commerce-flaw-cve-2025-54236/ #TheCyberExpressNews #Vulnerabilities #TheCyberExpress #FirewallDaily #AdobeCommerce #SessionReaper #CVE202554236 #CyberNews #Magento
-
Adobe Issues Urgent Patch for ‘SessionReaper’ Vulnerability in Commerce and Magento https://thecyberexpress.com/adobe-commerce-flaw-cve-2025-54236/ #TheCyberExpressNews #Vulnerabilities #TheCyberExpress #FirewallDaily #AdobeCommerce #SessionReaper #CVE202554236 #CyberNews #Magento
-
Adobe Issues Urgent Patch for ‘SessionReaper’ Vulnerability in Commerce and Magento https://thecyberexpress.com/adobe-commerce-flaw-cve-2025-54236/ #TheCyberExpressNews #Vulnerabilities #TheCyberExpress #FirewallDaily #AdobeCommerce #SessionReaper #CVE202554236 #CyberNews #Magento
-
⚠️ si tu administres (ou sais que) ton site e-commerce tourne sur Magento / Adobe Commerce : c’est LE moment de le mettre à jour
Une faille critique baptisée SessionReaper (CVE-2025-54236) a été rendue publique. Elle permet à un attaquant, sans aucune authentification, de prendre le contrôle d’une boutique en ligne, d’accéder aux comptes clients… et dans certains cas d’exécuter du code à distance sur le serveur.
👉 En clair : risque important de vol d’infos de paiement, compromission massive de boutiques, déploiement de malwares.Adobe a publié un patch d’urgence hors calendrier
👇
https://helpx.adobe.com/security/products/magento/apsb25-88.html
⬇️
https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397Selon la société spécialisée Sansec:
« Cela n’aide pas que le patch Adobe ait fuité accidentellement la semaine dernière, donc il est possible que des acteurs malveillants travaillent déjà sur un code d’exploitation. »(https://sansec.io/research/sessionreaper)
Qui est concerné ?
Adobe Commerce (tous déploiements) : 2.4.9-alpha2 et toutes les versions antérieures jusqu’à 2.4.4-p15 inclus
Magento Open Source : mêmes versions affectées
Adobe Commerce B2B : 1.5.3-alpha2 et antérieures jusqu’à 1.3.3-p15 inclus
Module Custom Attributes Serializable : 0.1.0 → 0.4.0
Que faire ?
Appliquer dès que possible le patch 👉 Adobe APSB25-88
Tester vos personnalisations : ce correctif désactive certaines fonctions internes, certains modules tiers risquent de casser
Si vous ne pouvez patcher dans les prochaines heures → activez un WAF (Fastly ou Sansec Shield). Adobe a déjà poussé de nouvelles règles WAF côté Cloud.
⚡ L’historique montre que les failles Magento de ce type (Shoplift 2015, TrojanOrder 2022, CosmicSting 2024…) sont exploitées (en masse) très rapidement et récursivement.
( https://vulnerability.circl.lu/vuln/CVE-2025-54236 )
#Magento #CyberVeille #AdobeCommerce #Cyberveille #CVE_2025_54236
-
⚠️ si tu administres (ou sais que) ton site e-commerce tourne sur Magento / Adobe Commerce : c’est LE moment de le mettre à jour
Une faille critique baptisée SessionReaper (CVE-2025-54236) a été rendue publique. Elle permet à un attaquant, sans aucune authentification, de prendre le contrôle d’une boutique en ligne, d’accéder aux comptes clients… et dans certains cas d’exécuter du code à distance sur le serveur.
👉 En clair : risque important de vol d’infos de paiement, compromission massive de boutiques, déploiement de malwares.Adobe a publié un patch d’urgence hors calendrier
👇
https://helpx.adobe.com/security/products/magento/apsb25-88.html
⬇️
https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397Selon la société spécialisée Sansec:
« Cela n’aide pas que le patch Adobe ait fuité accidentellement la semaine dernière, donc il est possible que des acteurs malveillants travaillent déjà sur un code d’exploitation. »(https://sansec.io/research/sessionreaper)
Qui est concerné ?
Adobe Commerce (tous déploiements) : 2.4.9-alpha2 et toutes les versions antérieures jusqu’à 2.4.4-p15 inclus
Magento Open Source : mêmes versions affectées
Adobe Commerce B2B : 1.5.3-alpha2 et antérieures jusqu’à 1.3.3-p15 inclus
Module Custom Attributes Serializable : 0.1.0 → 0.4.0
Que faire ?
Appliquer dès que possible le patch 👉 Adobe APSB25-88
Tester vos personnalisations : ce correctif désactive certaines fonctions internes, certains modules tiers risquent de casser
Si vous ne pouvez patcher dans les prochaines heures → activez un WAF (Fastly ou Sansec Shield). Adobe a déjà poussé de nouvelles règles WAF côté Cloud.
⚡ L’historique montre que les failles Magento de ce type (Shoplift 2015, TrojanOrder 2022, CosmicSting 2024…) sont exploitées (en masse) très rapidement et récursivement.
( https://vulnerability.circl.lu/vuln/CVE-2025-54236 )
#Magento #CyberVeille #AdobeCommerce #Cyberveille #CVE_2025_54236
-
⚠️ si tu administres (ou sais que) ton site e-commerce tourne sur Magento / Adobe Commerce : c’est LE moment de le mettre à jour
Une faille critique baptisée SessionReaper (CVE-2025-54236) a été rendue publique. Elle permet à un attaquant, sans aucune authentification, de prendre le contrôle d’une boutique en ligne, d’accéder aux comptes clients… et dans certains cas d’exécuter du code à distance sur le serveur.
👉 En clair : risque important de vol d’infos de paiement, compromission massive de boutiques, déploiement de malwares.Adobe a publié un patch d’urgence hors calendrier
👇
https://helpx.adobe.com/security/products/magento/apsb25-88.html
⬇️
https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397Selon la société spécialisée Sansec:
« Cela n’aide pas que le patch Adobe ait fuité accidentellement la semaine dernière, donc il est possible que des acteurs malveillants travaillent déjà sur un code d’exploitation. »(https://sansec.io/research/sessionreaper)
Qui est concerné ?
Adobe Commerce (tous déploiements) : 2.4.9-alpha2 et toutes les versions antérieures jusqu’à 2.4.4-p15 inclus
Magento Open Source : mêmes versions affectées
Adobe Commerce B2B : 1.5.3-alpha2 et antérieures jusqu’à 1.3.3-p15 inclus
Module Custom Attributes Serializable : 0.1.0 → 0.4.0
Que faire ?
Appliquer dès que possible le patch 👉 Adobe APSB25-88
Tester vos personnalisations : ce correctif désactive certaines fonctions internes, certains modules tiers risquent de casser
Si vous ne pouvez patcher dans les prochaines heures → activez un WAF (Fastly ou Sansec Shield). Adobe a déjà poussé de nouvelles règles WAF côté Cloud.
⚡ L’historique montre que les failles Magento de ce type (Shoplift 2015, TrojanOrder 2022, CosmicSting 2024…) sont exploitées (en masse) très rapidement et récursivement.
( https://vulnerability.circl.lu/vuln/CVE-2025-54236 )
#Magento #CyberVeille #AdobeCommerce #Cyberveille #CVE_2025_54236
-
⚠️ si tu administres (ou sais que) ton site e-commerce tourne sur Magento / Adobe Commerce : c’est LE moment de le mettre à jour
Une faille critique baptisée SessionReaper (CVE-2025-54236) a été rendue publique. Elle permet à un attaquant, sans aucune authentification, de prendre le contrôle d’une boutique en ligne, d’accéder aux comptes clients… et dans certains cas d’exécuter du code à distance sur le serveur.
👉 En clair : risque important de vol d’infos de paiement, compromission massive de boutiques, déploiement de malwares.Adobe a publié un patch d’urgence hors calendrier
👇
https://helpx.adobe.com/security/products/magento/apsb25-88.html
⬇️
https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-27397Selon la société spécialisée Sansec:
« Cela n’aide pas que le patch Adobe ait fuité accidentellement la semaine dernière, donc il est possible que des acteurs malveillants travaillent déjà sur un code d’exploitation. »(https://sansec.io/research/sessionreaper)
Qui est concerné ?
Adobe Commerce (tous déploiements) : 2.4.9-alpha2 et toutes les versions antérieures jusqu’à 2.4.4-p15 inclus
Magento Open Source : mêmes versions affectées
Adobe Commerce B2B : 1.5.3-alpha2 et antérieures jusqu’à 1.3.3-p15 inclus
Module Custom Attributes Serializable : 0.1.0 → 0.4.0
Que faire ?
Appliquer dès que possible le patch 👉 Adobe APSB25-88
Tester vos personnalisations : ce correctif désactive certaines fonctions internes, certains modules tiers risquent de casser
Si vous ne pouvez patcher dans les prochaines heures → activez un WAF (Fastly ou Sansec Shield). Adobe a déjà poussé de nouvelles règles WAF côté Cloud.
⚡ L’historique montre que les failles Magento de ce type (Shoplift 2015, TrojanOrder 2022, CosmicSting 2024…) sont exploitées (en masse) très rapidement et récursivement.
( https://vulnerability.circl.lu/vuln/CVE-2025-54236 )
#Magento #CyberVeille #AdobeCommerce #Cyberveille #CVE_2025_54236
-
Adobe Commerce is under threat—a new flaw, SessionReaper, lets hackers hijack live sessions like an open front door. Learn why immediate patching is crucial to keep your eCommerce safe.
#sessionreaper
#adobecommerce
#magento
#cybersecurity
#vulnerability -
Adobe Commerce is under threat—a new flaw, SessionReaper, lets hackers hijack live sessions like an open front door. Learn why immediate patching is crucial to keep your eCommerce safe.
#sessionreaper
#adobecommerce
#magento
#cybersecurity
#vulnerability