Security research
Technical breakdowns of what actually breaks Magento & Adobe Commerce stores — critical CVEs, card skimmers, and misconfigurations. Root cause, how attackers abuse it, real-world examples, and the exact fix. Sourced from the advisories and research, not marketing.
A nested-deserialization flaw in the Commerce REST API lets an attacker take over customer sessions and, in some configs, run code — no login required. Here is the root cause, how it is abused, and exactly how to check and fix it.
9 min read
An unauthenticated XML external entity flaw that reads any file on the server — including the encryption key that protects customer data. Combined with a second bug it becomes full remote code execution. What it is, who got hit, and how to remediate.
8 min read
Template injection in Magento 2 order emails let attackers place a malicious order and run code on the server. It kicked off a wave of holiday-season compromises. The mechanism, the real-world campaigns, and the fix.
7 min read
Magento 1 hit end of life on 30 June 2020 after SUPEE-11346. Every flaw since — starting with the 9.8-rated CVE-2020-9664 — has no vendor patch. What Cardbleed exploited, how to check a store, and why OpenMage LTS is the realistic bridge.
6 min read
Charles Fol's PRODSECBUG-2198 turned a storefront product-tracking endpoint into unauthenticated SQL injection via a placeholder-reuse bug in prepareSqlCondition() — and a read-only leak into admin takeover. Root cause, exploitation, and the NVD-authoritative patch path. (The RCE that completed the chain was a separate CVE.)
6 min read
CVE-2015-1397 is the SQL injection at the centre of the Magento 1 "Shoplift" chain — an unauthenticated grid-export flaw that let attackers write admin accounts straight into the database. Patched by SUPEE-5344 in February 2015, it was mass-exploited within a day of disclosure. The mechanism, the indicators of compromise, and the fix.
6 min read