Magecart
Security incidents tagged Magecart. Newest first.
0 Magecart incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 0
- Days without an incident
- 0
- Longest quiet run: 369 days (Jul 10–Jul 13)
Show 1 older incident1 older incident
July 2025 1
- HighPartly patched
Magento CMS-block loader campaign hits 953 stores via PolyShell and SessionReaper
Sansec reports a criminal group that has injected a JavaScript loader into the cms_block table of 953 online stores since July 2025, mostly Magento. The newest loader domain, deepveindrilling.com (registered Oct 6, 2026), was found on 83 stores, and since Oct 23 it fingerprints visitors so scanners get nothing. Sansec ties initial access to PolyShell (CVE-2026-48356, fixed in Adobe APSB26-73) and SessionReaper (CVE-2025-54236, APSB25-88), plus rogue admin accounts on fully patched stores. Store owners should patch, audit cms_block and cms_page, remove rogue admins and rotate credentials.
Adobe Commerce / Magento Open SourceSince Jul 9, 2025
