Sansec

@sansecio

Experts in ecommerce security. Helping merchants in times of peril. Tracking large scale digital skimming since 2015. PGP key 9D0D094CD2C7E669

Amsterdam sansec.io Joined February 2019

16 Following 1.8K Followers 440 Posts

Latest posts 5

Sansec @sansecio Oct 15

🚨 BlockStrap (Magento / Adobe Commerce, CVSS 10.0)

We've reproduced several RCE chains and expect threat actors to follow suit imminently.

If you haven't patched yet, we strongly urge you to do so now.

sansec.io/research/block…

sansec.io BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849) BlockStrap (CVE-2026-103849) is a CVSS 10.0 Magento and Adobe Commerce flaw that gives unauthenticated attackers remote code execution. Adobe fixed it on Oct...

Sansec @sansecio Sep 5

🚨 We discovered StyleSmuggler, an unauthenticated RCE in Magento & Adobe Commerce under active exploitation. Confirmed on clean 2.4.7, 2.4.8 and 2.4.9 installs. PHP executes during failed payment email rendering.

Our research: sansec.io/research/style…

sansec.io StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack Sansec discovered StyleSmuggler, a Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. Attacks started September ...

Sansec @sansecio May 14

Critical FunnelKit vulnerability threatens 40,000+ WooCommerce checkouts. We're already seeing exploitation in the wild.
sansec.io/research/funne…

sansec.io Critical FunnelKit vulnerability threatens 40,000+ WooCommerce checkouts A critical vulnerability in Funnel Builder by FunnelKit threatens more than 40,000 WooCommerce checkouts. Sansec is observing active exploitation, with attac...

Sansec @sansecio Oct 22, 2025

🚨 SessionReaper (CVE-2025-54236) is now actively exploited while 62% of Adobe Commerce/Magento stores remain unpatched. We expect automated mass attacks within 48 hours. sansec.io/research/sessi…

sansec.io SessionReaper attacks have started, 3 in 5 stores still vulnerable Six weeks after Adobe's emergency patch, SessionReaper (CVE-2025-54236) has entered active exploitation. Sansec Shield blocked dozens of attacks today. With ...

Sansec @sansecio Sep 8, 2025

Urgent: Adobe will drop critical patch tomorrow, outside of regular patch cycle. Fixes SessionReaper attack, affects Adobe Commerce / Magento 2.3.1+. Concept patch accidentally leaked.

sansec.io/research/sessi…

sansec.io SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025-54236) SessionReaper (CVE-2025-54236) is a critical bug in Magento & Adobe Commerce. The bug may hand full control of a store to unauthenticated attackers. Auto...