Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Attackers exploited CVE-2025-54236, a critical flaw in Adobe Commerce and Magento Open Source known as SessionReaper. Adobe rated it CVSS 9.1 and confirmed exploitation in the wild on October 22, 2025. Merchants running an affected release should install Adobe’s fix across every production node—and investigate for compromise if the store was exposed before patching. A software update can stop future exploitation; it does not remove malware or undo data theft that may already have occurred.
What happened with the Adobe Commerce flaw?
Adobe published an emergency fix for CVE-2025-54236 in security bulletin APSB25-88 on September 9, 2025. The flaw stems from improper input validation in Commerce’s Web API and session-handling paths. Adobe classifies the impact as a security-feature bypass; the vulnerability requires neither authentication nor administrative privileges and carries a CVSS 3.1 score of 9.1 Critical. Adobe later revised the bulletin to confirm exploitation in the wild on October 22, 2025. Adobe’s security bulletin contains the official version and remediation details.
Sansec reported that public technical analysis preceded a wave of attack attempts on October 22. It said it observed more than 250 attempts, including PHP webshell payloads and phpinfo probes. Sansec also estimated that 38% of stores had applied the fix at that point; that figure reflects Sansec’s own telemetry, not a verified census of all Commerce and Magento stores. Sansec’s exploitation report describes its observations.
The issue was publicly patched before the October mass exploitation Sansec described, so calling that activity a zero-day would be misleading. Sansec reported that Adobe’s emergency fix had leaked in August and that public analysis later made the attack path more accessible. Adobe’s bulletin confirms the patch and subsequent in-the-wild exploitation, but does not itself characterize the flaw as unauthenticated remote code execution. That broader assessment comes from Sansec.
#1 Best Overall
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- Comprehensive Coverage: This BookFactory log book includes essential fields such as post/shift, time of change, date, weather conditions, and a designated space for detailed notes. This ensures that all relevant information is captured and easily accessible.
- Sturdy Cover: The trans-lux cover protects the log book from wear and tear, ensuring its longevity and maintaining the integrity of your recorded data.
- Essential Security Tool: This log book is an indispensable tool for any organization that values security and accountability. It helps to prevent misunderstandings, improve communication, and ensure a smooth transition between shifts.
- Wire-O with Trans-lux cover, 100 Pages, Dimensions 8.5" x 11" - (Security-Pass-Down) Reorder SKU: LOG-100-7CW-PP(Security-Pass-Down)
Why the vulnerability is serious
Adobe describes CVE-2025-54236 as a security-feature bypass. The National Vulnerability Database entry records high confidentiality and integrity impacts, including session takeover. In practical terms, a successful attack could put customer accounts and store data at risk.
Sansec reported that, under certain conditions, exploitation could progress to unauthenticated remote code execution, account takeover, and deployment of PHP backdoors or webshells. Its reproduced RCE path appeared to depend on file-based session storage. Sansec nevertheless urged stores using Redis or database-backed sessions to act, because other abuse paths may exist. These are independent researcher findings, not Adobe’s wording for the vulnerability.
Rank #2
- Made in USA - Proudly produced in Ohio by a Veteran-owned business
- This BookFactory log book is for security guards in any sector or business. You can report location, circumstances and report number.
- There are spaces to log the individual's names address, description and other identifying information. There are also spaces to note others involved, notes, and vehicle information if one was involved
- Wire-O, 100 Pages, Dimensions 3.5" x 5.25"
- Reorder SKU: LOG-100-M3CW-PP(Security-Report)
Sansec also reported a separate concern involving the customer-address upload controller at /customer/address_file/upload. It said its emergency-fix analysis found that the fix addressed the session-deserialization issue but did not remove every risk associated with unrestricted uploads. Sansec recommended checking for malicious uploads and considering additional controls. Treat this as Sansec’s assessment and mitigation advice, not as an Adobe bulletin instruction.
Which versions are affected?
Adobe’s bulletin lists the following affected versions and earlier releases. Patch-level boundaries matter: for example, “2.4.7-p7 and earlier” does not mean every 2.4.7 release is affected regardless of patch level.
| Product | Affected versions and earlier |
|---|---|
| Adobe Commerce | 2.4.9-alpha2; 2.4.8-p2; 2.4.7-p7; 2.4.6-p12; 2.4.5-p14; 2.4.4-p15 |
| Adobe Commerce B2B | 1.5.3-alpha2; 1.5.2-p2; 1.4.2-p7; 1.3.4-p14; 1.3.3-p15 |
| Magento Open Source | 2.4.9-alpha2; 2.4.8-p2; 2.4.7-p7; 2.4.6-p12; 2.4.5-p14 |
Adobe Commerce is the commercial Magento-based commerce platform; Magento Open Source is its freely available counterpart. This advisory concerns the product releases listed above, not every Magento extension, hosted storefront, or Adobe product. Adobe says its hotfix is compatible with Commerce and Magento Open Source versions between 2.4.4 and 2.4.7. For other branches or newer releases, follow the bulletin and applicable release notes rather than assuming a particular package resolves the issue.
What merchants should do
- Inventory every deployment. Check the exact product and patch level in the hosting control plane and on the running application. In a Composer-based deployment, examples include
bin/magento --version,composer show magento/product-community-edition, orcomposer show magento/product-enterprise-edition. Which package appears depends on the deployment; these checks are not a substitute for Adobe’s instructions. - Apply Adobe’s fix or a release that includes it. Use the remediation Adobe specifies for the installed branch. Verify that the fix is present in the deployed code, not merely in a repository or build artifact.
- Verify every node and environment. Check production web and API nodes, queue consumers, cron workers, containers, blue/green or standby instances, autoscaling templates, disaster-recovery systems, and any internet-accessible staging environment. A patched server does not protect requests still routed to an unpatched node.
- Use a WAF as a temporary compensating control if patching is delayed. A WAF may help block known patterns while a fix is tested, but it is not a replacement for application remediation and cannot establish that the store is uncompromised.
- Preserve evidence before cleanup if compromise is possible. Export web-server, CDN/WAF, application, authentication, and database logs; record suspicious file timestamps and hashes; capture relevant request paths and deployment times; and snapshot systems where practical. Avoid deleting files or rebuilding before preserving evidence if a formal investigation may be needed.
- Investigate for indicators of compromise. Review unusual unauthenticated REST API activity and session behavior, requests to
/customer/address_file/upload, unexpected PHP files under writable media directories, recently changed PHP files, phpinfo probes, webshell-like code, new administrator accounts, unfamiliar API tokens, modified CMS blocks or checkout scripts, and unexpected outbound connections from the web tier. Sansec reported webshell and phpinfo payloads; this is a defensive checklist, not a complete official indicator list. - Rotate exposed secrets and credentials. If there are compromise indicators, rotate administrator and database passwords, cloud and SSH keys, API and integration tokens, payment-gateway and SMTP credentials, CDN/WAF credentials, and CI/CD deployment secrets. Sansec specifically recommends rotating the Magento cryptographic key if compromise is found, noting that a stolen key could enable persistent CMS-block changes.
- Review customer and payment exposure. Assess access to customer accounts and data, payment systems, administrator functions, and integrations. Involve your incident-response provider, payment processor, insurer, and legal counsel as appropriate; applicable notification duties depend on the facts and jurisdiction.
- Restore from known-good sources if integrity cannot be established. If you cannot determine whether code, credentials, or data have been altered, work with qualified responders on containment and a clean rebuild or restoration rather than treating the patch as proof of recovery.
What patching does—and does not—accomplish
Applying Adobe’s fix closes the vulnerability addressed by the fix on the patched deployment. It does not establish that an attacker did not exploit the store earlier, nor does it remove a webshell, backdoor, rogue administrator, unauthorized API token, modified CMS block, altered checkout or payment script, stolen session, or compromised credential.
Rank #4
Adobe’s emergency hotfix can be a faster, lower-disruption option for a supported deployment that needs time to test a full upgrade. A broader upgrade may include other security fixes and help move a store away from an older release, but custom modules, themes, payment integrations, or database changes can introduce compatibility issues and require a planned maintenance window. Backups and rollback planning matter whichever route you take.
Similarly, a WAF may reduce exposure while remediation is underway, but signatures can be bypassed, rules vary by deployment, and filtering cannot clean an already compromised server. Scanners can help with triage; they do not necessarily establish the scope of payment-data access or replace a forensic investigation. Managed hosting can assist with patching, monitoring, backups, or WAF integration, but merchants should confirm whether the provider also covers custom code, extensions, and customer-managed containers.
How to interpret the attack reports
Keep the evidence categories distinct. Adobe’s bulletin establishes the affected releases, severity, authentication requirements, fix, and its October 22, 2025 confirmation of in-the-wild exploitation. Sansec’s technical reports provide the SessionReaper name, its assessment of possible attack chains and file-upload exposure, and its observed payloads and attack counts. Sansec’s later estimates—including reports that attacks reached about 49% of stores by October 26, 16–18% of Magento stores had one or more injected backdoors, and 81% had been visited by a SessionReaper attack by November 1—are telemetry-based estimates, not independently audited global prevalence figures. See Sansec’s technical overview.
For the incident’s broader reporting chronology, SecurityWeek’s coverage reported Adobe’s exploitation confirmation and the patch-rate estimate. Neither a reported attack against some stores nor a telemetry estimate proves that a particular merchant was compromised. That determination requires reviewing the specific store’s logs, files, accounts, and deployment history.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
