security

Deploying patches is simple for in-house development teams or smaller Agencies maintaining only a few stores. Manually applying patches per project is simple, but doesn’t scale well. Both from time cost and security exposure perspectives.

Since Searchlight Cyber published a technical write up and proof-of-concept for the SessionReaper vulnerability, attackers have been mass scanning Magento / Adobe Commerce stores for vulnerable targets. The first phase of the attack involves uploading a payload containing malicious session data to the server.

A recent vulnerability in Adobe's e-commerce platform, identified as CVE-2025-54236, poses risks of remote code execution, particularly through file-based session storage, which can be exploited by unauthenticated users. The article analyzes the patch related to this vulnerability, its deserialization mechanisms, and offers insights into potential exploitation methods and vulnerabilities remaining in the application. The narrative provides a deep dive into the exploit chain and necessary payloads while exploring the implications of session management and type handling in the context of security.

This project enhances the security framework of your online store by fine-tuning the Content Security Policy (CSP). It specifically reduces risks associated with unnecessary domain allowances that can lead to XSS vulnerabilities, ensuring safer loading of resources. With this extension, domains in the csp_whitelist.xml files are managed more effectively to improve overall security.

This module for Magento 2 allows you to block bots and reported IPs that consume your server resources and degrade your site's performance. It includes blacklists, whitelists, and a tool that lets you analyze logs to find out which bots are visiting your site. Don't try to replace WAF or Cloudflare, it's just another resource.