✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Fashion/Apparel
Breach intelligence, attack campaigns, and threat reports targeting the Fashion/Apparel sector.
Explore Other Sectors
Fashion/Apparel Threat Reports
CISA Highlights Critical Magento Vulnerability CVE-2026-45247 Amid Active Exploitation
In early June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-45247 to its Known Exploited Vulnerabilities (KEV) catalog, following reports of active exploitation. This critical vulnerability, with a CVSS score of 9.8, affects Mirasvit's Full Page Cache Warmer extension for Magento 2 versions prior to 1.11.12. The flaw allows unauthenticated attackers to execute arbitrary PHP code on affected servers by sending crafted serialized PHP objects via the CacheWarmer cookie. Exploitation has been observed targeting gaming and business websites, particularly in the U.S., U.K., France, and Australia. Organizations are urged to apply the provided patches by June 6, 2026, and audit for suspicious CacheWarmer cookie values indicative of exploitation attempts. The inclusion of CVE-2026-45247 in the KEV catalog underscores the persistent threat posed by deserialization vulnerabilities in widely used web applications. This incident highlights the importance of timely patching and vigilant monitoring to prevent unauthorized code execution and potential data breaches.
3 weeks ago
Kill Chain
PolyShell Attacks Compromise Over Half of Vulnerable Magento Stores
In March 2026, attackers began exploiting the 'PolyShell' vulnerability in Magento Open Source and Adobe Commerce installations, affecting over half of all vulnerable stores. The flaw resides in Magento's REST API, which improperly handles file uploads, allowing attackers to execute remote code or perform account takeovers via stored cross-site scripting (XSS). Adobe released a fix in version 2.4.9-beta1 on March 10, 2026, but it has not yet reached the stable branch. This incident underscores the critical importance of timely patch management and the need for robust security configurations to prevent exploitation of known vulnerabilities. The rapid exploitation following public disclosure highlights the urgency for organizations to stay vigilant and proactive in their cybersecurity practices.
3 months ago
Kill Chain
Over 250 Magento Stores Breached Overnight Through Critical Adobe Commerce Flaw
In October 2025, over 250 Magento and Adobe Commerce online stores were compromised in less than 24 hours after attackers exploited a newly disclosed critical vulnerability, CVE-2025-54236 (CVSS 9.1). The flaw, stemming from improper input validation, allowed threat actors to compromise e-commerce shops directly via their web applications, enabling unauthorized access, data exfiltration, and potential payment card theft. Security researchers observed an automated wave of exploitation attempts soon after public disclosure, underlining how rapidly threat actors weaponize emerging vulnerabilities for financial gain and to cause operational disruption. This incident highlights the urgent need for rapid patch management and layered web application defenses, as attackers increasingly leverage zero-day and recently disclosed vulnerabilities to target widely used commerce platforms, further increasing risks to consumer data and regulatory compliance for online retailers.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports