惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

博客园_首页
H
Help Net Security
N
Netflix TechBlog - Medium
Apple Machine Learning Research
Apple Machine Learning Research
P
Proofpoint News Feed
A
About on SuperTechFans
V
V2EX
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
宝玉的分享
宝玉的分享
aimingoo的专栏
aimingoo的专栏
F
Fortinet All Blogs
博客园 - 【当耐特】
Microsoft Security Blog
Microsoft Security Blog
Martin Fowler
Martin Fowler
I
InfoQ
Google DeepMind News
Google DeepMind News
人人都是产品经理
人人都是产品经理
Engineering at Meta
Engineering at Meta
腾讯CDC
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
B
Blog RSS Feed
U
Unit 42
The Cloudflare Blog
Y
Y Combinator Blog

Sansec - experts in eCommerce security

GorgonAgora: 4,800+ fake storefronts skim cards across hundreds of impersonated brands Sansec adds support for Sylius 1 & 2 Critical vulnerability in Mirasvit Cache Warmer for Magento Critical FunnelKit vulnerability threatens 40,000+ WooCommerce checkouts Composer vulnerability leaks GitHub tokens, threatens PHP supply chain Over 200 PrestaShop stores expose installer, allowing full takeover ClickFix malware hits DoD cybersecurity vendor homepage SVG Onload Tag Hides Magecart Skimmer on 99 Stores Mass PolyShell attack wave hits 471 stores in one hour Novel WebRTC skimmer bypasses security controls at $100+ billion car maker PolyShell: unrestricted file upload in Magento and Adobe Commerce Digital skimmer hits global supermarket chain Building a faster YARA engine in pure Go Magento Developers Impersonated in Targeted GitHub Malware Operation Claude finds 353 zero-days on Packagist The billion-dollar security.txt problem Keylogger targets 200,000+ employees at major US bank ConnectPOS leaked Github secrets for years Critical backdoor found in MGT Varnish extension SessionReaper attacks have started, 3 in 5 stores still vulnerable SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025-54236) Adobe patches critical Magento admin takeover via menu injection Backdoor found in popular ecommerce components Found defunct.dat on your site? You've got a problem. You have 2 weeks left to set up CSP for your store Merchants left guessing at last-minute PCI-DSS u-turn Magento Security Release APSB25-08 [Impact Analysis] Sorry, client-side security does not work Google services abused in skimming campaigns Thousands of Adobe Commerce stores hacked in competing CosmicSting campaigns
Do these two things to keep your Magento 1 store running ...
Sansec Forensics Team · 2020-05-28 · via Sansec - experts in eCommerce security

Over a 100 thousands Magento 1 stores will be running after Adobe terminates support in June (end-of-life). Many merchants need more time to transition to Magento 2 or another platform. No need to panic, your store will not suddenly crash on July 1st. But you should make two important arrangements to enjoy continued payments and to prevent a security incident.

It boils down to getting the proper updates in place, at the right time. Or a brick & mortar analogy: you need a security camera and solid locks.

First: know WHEN an update is required

Hackers typically exploit software bugs to get into your store. Critical bugs in Magento or third party components are discovered about once or twice per month. Not all bugs apply to every store, but when one does, you really want to get a fix in place within 48 hours of the bug publication. Some bugs are exploited within hours on a massive scale.

Tracking these bugs in Magento and perhaps a few dozen installed extensions is very time consuming. So let software do that for you! Our eComscan monitoring solution is specifically made to find critical issues in Magento stores and third party components.

Additionally, eComscan will also discover malicious activity and find previously hidden backdoors. This is essential information for any store owner.

Second: know WHERE to get a future update

When eComscan discovers a critical bug in your Magento 1 store platform, it will alert you right away, and suggest an emergency fix. However, this only functions as first line of defense. You should get a proper, functional patch installed within 2 weeks. Adobe will no longer provide these patches, but several parties have stepped in.

Mage-One offers commercial Magento 1 support contracts. This is a recommended solution, when you do not have senior, experienced Magento developers on-site.

An open-source solution is OpenMage, which promises community-sourced patches. Installation and testing requires a capable developer.

Summary: prepare yourself

Keeping your Magento 1 store up and secure beyond June, 2020, requires a bit of preparation. We recommend merchants to implement monitoring for visibility into their risk situation. And merchants should learn about the available channels for future Magento 1 patches.

To protect as many Magento 1 stores as possible, we have launched a promotion. Use coupon M1SECURE to enjoy a 50% discount on a new 3 month eComscan subscription for your Magento 1 store.

Read more: What about Magento 1 and PCI compliance?

Read more