Backdoor found in popular ecommerce components
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 99% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 83ba291cd9201e9a28173741bac82745 | oded checksum and salt: class License { const SECURE_KEY = '83ba291cd9201e9a28173741bac82745' ; const SIGN_KEY = 'afa3a778bd34181c44f2dfe1de8aff05' ; Th |
| md5 | afa3a778bd34181c44f2dfe1de8aff05 | EY = '83ba291cd9201e9a28173741bac82745' ; const SIGN_KEY = 'afa3a778bd34181c44f2dfe1de8aff05' ; The fake license check is explicitly activated via regis |
From the original article
3 min read at sansec.io
Hundreds of stores, including a $40 billion multinational, are running backdoored versions of popular ecommerce software. We found that the backdoor is actively used since at least April 20th. Sansec identified these backdoors in the following packages which were published between 2019 and 2022.
By Sansec Forensics Team · sansec.io
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.