Major Magento/Adobe Commerce Security Threat 🚨
In the last 20 hours, Sansec has identified over 2,000 hacked Adobe Commerce / Magento stores, and the number is still climbing.
Group Peschanki, known for their aggressive, automated attack campaigns, is behind this surge — and they’re not slowing down. 😬
The suspected attack vector is CosmicSting, a vulnerability in Magento that allows attackers to modify CMS blocks and inject payment skimmers into the checkout flow. Simply upgrading your system won’t be enough — it’s crucial to manually disable your previous cryptographic keys.
What to Do:
- Run a server-side malware scanner like eComscan
- Upgrade to Magento 2.4.7-p3
- Rotate your crypt key
- Manually disable old crypt keys
This is the largest automated Magento hack we've seen since the Shoplift attack in 2015.
Info from Sansec in comments on how to fix it.
Reach out (inmail or comment) if you need help with this or have questions. 👋
Let's fix this today. ⌨
#Magento#security#adobecommerce#ecommerce
The tool your security team trusts the most just became the thing an attacker used to get in. That is not a hypothetical. It happened this week.
A critical vulnerability was found in FortiClient EMS, the platform many organizations use to manage endpoint security across their entire network. The flaw allows unauthenticated remote code execution. And it was already being exploited in the wild before the patch dropped.
CISA ordered federal agencies to fix it by Friday. Let me put that in plain language for every business owner reading this: the software your IT team installed to protect your computers had a hole in it, and someone found it before your team did.
The landscape has fundamentally shifted. Attackers are no longer just looking for weak passwords or unpatched servers. They are actively targeting the very security infrastructure designed to keep them out.
When threat actors compromise a management platform like FortiClient EMS, they gain the keys to the kingdom. They can push malicious updates, disable protections, and move laterally across your network, all while hiding behind trusted software.
This is the part of cybersecurity that does not get talked about enough. We buy tools and assume they are working. We deploy a firewall and move on. We install endpoint protection and check the box.
But security tools are software. And software has vulnerabilities. The thing protecting you needs protecting too. The traditional "deploy and forget" mindset has created a massive blind spot for businesses. Relying solely on automated updates without independent verification is no longer sufficient.
Here are four concrete steps you can take today to secure your environment:
1. Verify Your Patch Status Immediately. Ask your IT team or MSP if you run FortiClient EMS. If yes, confirm that the latest patch has been successfully applied across all endpoints.
2. Audit Your Security Stack. Ask when the last time was that any of your security tools were audited. At CyberGlobal | New Jersey, we see this constantly.
3. Implement Least Privilege Access. Ensure that your security management platforms are only accessible to authorized personnel.
If the tool you trust the most failed tomorrow, what is your backup plan? You need secondary monitoring and response capabilities that do not rely solely on your primary endpoint protection. Having the global expertise of CyberGlobal behind our local delivery means we build these redundancies into every strategy we deploy for New Jersey businesses.
Failing to patch known, exploited vulnerabilities is not just a security risk, it is a compliance failure. Whether you are navigating the FTC Safeguards Rule, HIPAA, or the NJDPA, regulators expect you to actively manage your vulnerabilities. Ignorance of a flaw in your own security tools is not a defensible position.
Peta-Gaye | CyberGlobal | New Jerseyhttps://lnkd.in/eZUfDmM3
Source: CISA KEV Catalog; Fortinet PSIRT Advisory, April 6, 2026
🚨 Patching More ≠ Being Secure
Most organizations focus on volume-based patching
👉 “How many vulnerabilities did we close?”
But attackers don’t care about numbers.
They care about exposure.
🎯 The Real Question is:
Which vulnerabilities can actually be exploited right now?
💡 Shift Your Mindset → Exposure-Driven Patching
Instead of patching everything, focus on:
🔥 Internet-Facing Assets
External apps, VPN, RDP, email gateways
→ Your first line of attack surface
👑 Crown Jewels
Critical systems & sensitive data
→ Where business impact is highest
⚠️ Actively Exploited Vulnerabilities
→ If it’s being used in the wild, it’s already late
🧠 Key Insight:
Not all vulnerabilities are equal
→ A low CVSS on an exposed system > high CVSS on isolated system
📉 What This Achieves:
✔ Reduced attack surface
✔ Faster risk reduction
✔ Better use of resources
✔ Less “patch fatigue”
🔥 Final Thought:
👉 Patch by exposure. Not by volume.
👉 Focus on what attackers will hit first—not what scanners show most.
#CyberSecurity#SOC#VulnerabilityManagement#RiskManagement#ThreatExposure#BlueTeam#InfoSec#CISO
Critical Security Alert for Adobe Commerce Users
On May 12, 2026, Adobe released a major security update addressing multiple critical and important vulnerabilities affecting both Adobe Commerce.
The risks are serious:
- Arbitrary Code Execution
- Privilege Escalation
- Security Feature Bypass
- Arbitrary File System Read
- Application Denial-of-Service (DoS)
Organizations delaying patch implementation could leave their eCommerce platforms exposed to active exploitation, customer data risks, operational downtime, and reputational damage.
Adobe Security Bulletin:
Adobe APSB26-49 Security Bulletin
Latest Adobe Commerce Security Updates:
Adobe Commerce Security Updates
For Adobe Commerce on Managed Services customers, Adobe recommends working directly with your Customer Success Engineer for patch deployment guidance.
If you support Adobe Commerce, NOW is the time to:
• Review affected versions
• Prioritize emergency patching
• Validate production deployments
• Audit custom modules/extensions
• Reassess WAF and monitoring rules
Cybersecurity is no longer optional for eCommerce businesses proactive patch management is one of the strongest defenses against modern attacks.
Please share this update with your network to help protect merchants, developers and customers across the ecosystem.
#AdobeCommerce#CyberSecurity#eCommerce#SecurityUpdate#InfoSec#ApplicationSecurity#DigitalCommerce#PatchManagement