Security research
Technical breakdowns of what actually breaks Magento & Adobe Commerce stores — critical CVEs, card skimmers, and misconfigurations. Root cause, how attackers abuse it, real-world examples, and the exact fix. Sourced from the advisories and research, not marketing.
The default /admin frontName, disabled 2FA, an admin URL shared with the storefront, and no source-IP restriction form one attack surface. How admin credential attacks work, why mandatory 2FA arrived in 2.4.0, and the exact env.php, CLI, and nginx changes that close each gap.
5 min read
Per-account lockout stops brute force but not credential stuffing, where one attempt per account across thousands of accounts evades every counter Magento ships. How the two attacks differ, and the layered Admin, reCAPTCHA, and edge-rate-limiting controls that actually hold.
5 min read
Magento_Csp ships most storefront pages in report-only mode, which enforces nothing. This is how report-only and restrict actually differ, why an over-broad whitelist still lets skimmers run, and the exact sequence to tune csp_whitelist.xml and flip to restrict without breaking checkout.
5 min read
Web skimmers steal card data straight from the checkout page. On Magento they hide in fake analytics domains, GTM containers, and even invisible SVG elements. A field guide to the techniques and the passive signals that expose them.
8 min read
Magento's /graphql endpoint answers introspection in production and rides on webonyx/graphql-php, whose OverlappingFieldsCanBeMerged validator can degrade to quadratic time — a single crafted inline-fragment query can burn a php-fpm worker before any resolver runs. The mechanism, how to detect it, and the isolated patch chain.
6 min read
If env.php is downloadable, an attacker has your database password, admin URL, and the encryption key that decrypts customer data. Why it happens, how it is found at scale, and how to lock it down.
6 min read
A nested-deserialization flaw in the Commerce REST API lets an attacker take over customer sessions and, in some configs, run code — no login required. Here is the root cause, how it is abused, and exactly how to check and fix it.
9 min read
Commercial Magento extensions run with core-level privilege on every request, which makes their license-check files an ideal home for a dormant backdoor. We dissect the 2025 Tigren/Meetanshi/MGS compromise, the 2022 FishPig/Rekoobe breach, and the polyfill.io skimmer — plus the exact grep and CSP checks to find and shut them down.
5 min read
An unauthenticated XML external entity flaw that reads any file on the server — including the encryption key that protects customer data. Combined with a second bug it becomes full remote code execution. What it is, who got hit, and how to remediate.
8 min read
Template injection in Magento 2 order emails let attackers place a malicious order and run code on the server. It kicked off a wave of holiday-season compromises. The mechanism, the real-world campaigns, and the fix.
7 min read
Magento 1 hit end of life on 30 June 2020 after SUPEE-11346. Every flaw since — starting with the 9.8-rated CVE-2020-9664 — has no vendor patch. What Cardbleed exploited, how to check a store, and why OpenMage LTS is the realistic bridge.
6 min read
Charles Fol's PRODSECBUG-2198 turned a storefront product-tracking endpoint into unauthenticated SQL injection via a placeholder-reuse bug in prepareSqlCondition() — and a read-only leak into admin takeover. Root cause, exploitation, and the NVD-authoritative patch path. (The RCE that completed the chain was a separate CVE.)
6 min read
CVE-2015-1397 is the SQL injection at the centre of the Magento 1 "Shoplift" chain — an unauthenticated grid-export flaw that let attackers write admin accounts straight into the database. Patched by SUPEE-5344 in February 2015, it was mass-exploited within a day of disclosure. The mechanism, the indicators of compromise, and the fix.
6 min read