Thousands of online stores at risk as SessionReaper attacks spread

Thousands of online stores are at risk as SessionReaper attacks spread, with Magento and its commercial counterpart Adobe Commerce affected by a remote code execution flaw tracked as CVE-2025-54236. The vulnerability lets attackers hijack live customer sessions and, in some setups, take full control of the store’s server, by exploiting improper input validation and unsafe handling of serialized data.

Early September a security researcher highlighted the flaw, and after a PoC was published, cybercriminals quickly built exploits, with attacks now spreading rapidly. According to SecPod, successful exploitation can lead to security feature bypass, customer account takeover, data theft, fraudulent orders and potentially remote code execution.

Researchers at Sansec reported seeing more than 250 Magento stores compromised within 24 hours of the exploit code going public, while a patch released on 9 September remains, six weeks on, unpatched in around 62% of Magento stores. Consumers are urged to patch Magento sites immediately, though ordinary shoppers face limited visibility to whether a store is secure. 23 October 2025.