Do Son "SessionReaper" (CVE-2025-54236) targets Magento stores. Attackers use zombie tokens to gain root access. 200+ sites compromised. Patch now.
SessionReaper
Akamai warns of active exploitation of Magento's SessionReaper flaw (CVE-2025-54236). The critical (CVSS 9.8) vulnerability allows session hijacking and unauthenticated RCE via web shells.
Adobe has released an emergency patch for a critical Magento flaw, SessionReaper (CVE-2025-54236). The bug could allow automated attacks against thousands of online stores.