Attackers Hijack 200+ Sites by Exploiting Magento Vulnerability

Cyberpress • January 30, 2026

Share: View original

These attacks leverage a critical vulnerability tracked as CVE-2025-54236, also known as “SessionReaper.” The flaw allows threat actors to bypass ...

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Magento Vulnerability Exploited in Attack on 200+ Websites In January 2026, attackers exploited a critical vulnerability in Magento, tracked as CVE-2025-54236, to hijack over 200 e-commerce websites. This severe authentication flaw allowed threat actors to gain complete control of the affected systems, marking a significant wave of coordinated web server compromises across various regions. 2 sources 50

Extracted Entities

Attack Types (1)

Zero-day Exploit

CVEs (1)

Platforms (1)

Vulnerabilities (1)