Magento and Adobe Commerce run some of the largest stores in the world, which makes them a constant target. The last two years have been brutal: the CosmicSting vulnerability breached thousands of stores, and in 2025 the SessionReaper flaw was used in automated attacks against roughly half of all Magento stores worldwide. Payment skimmers have ended up on the checkout pages of major brands. If you run a Magento store and security is not a priority, you are already exposed.
This guide is the store owner’s view of Magento security in 2026: the top threats to know about, the hidden danger of running an end-of-life version, what PCI compliance now demands, and a practical checklist to secure your store. None of this is theoretical, the data below is from real, ongoing attacks.
Of stores hit by 2025 mass attacks
Stores breached by CosmicSting
Of stores hit with a checkout skimmer
Year Magento 1 lost security support
To secure your Magento store, apply Adobe security patches as soon as they are released, run a supported version rather than an end-of-life one, rotate your encryption (crypt) key after any patch delay, enforce strong admin authentication with two-factor, monitor for skimmers and file changes, and keep up with PCI DSS requirements for payment-page scripts. Most breaches exploit known, already-patched vulnerabilities, so fast patching and a supported version are the two highest-impact steps you can take.
Magento’s flexibility and market share make it one of the most attacked eCommerce platforms in the world. Attackers automate the hunt for unpatched stores and move fast: when the CosmicSting vulnerability was disclosed, security firm Sansec recorded stores being hacked at a rate of 5 to 30 per hour during peak periods, with over 4,200 stores compromised.
2025 was worse. The SessionReaper vulnerability, an unauthenticated remote code execution flaw, was used in mass automated attacks that hit roughly 49% of all Magento stores, and Sansec estimated that 16% to 18% of stores ended up with one or more backdoors injected. Around 5% of all Adobe Commerce and Magento stores had a payment skimmer placed on their checkout over a single summer, and the victim list includes household names such as Swatch, Ray-Ban, Cisco, Carlsberg, Segway and Whirlpool.
The uncomfortable truth is that almost all of these breaches exploited known vulnerabilities for which a patch already existed. The stores that were hit were the ones that did not patch fast enough. That is good news in one sense: Magento security is largely about discipline and speed, not luck, and the steps that protect you are well understood.
If you only do one thing after reading this, patch faster. The gap between a patch being released and you applying it is the window attackers live in.
A handful of threat types account for the vast majority of Magento breaches. Knowing how they work tells you exactly what to defend against.
- Magecart and payment skimmers. Attackers inject malicious JavaScript into your store, often into CMS blocks or third-party scripts, to silently steal card details as customers type them at checkout. The skimmer is invisible to shoppers, and most merchants only find out weeks later.
- Known CVEs like CosmicSting and SessionReaper. These are critical vulnerabilities in the platform itself. CosmicSting (CVE-2024-34102) let attackers steal a store’s encryption key and mint admin tokens; SessionReaper (CVE-2025-54236) allowed remote code execution. Both were exploited at scale within days of disclosure.
- Stolen crypt keys and backdoors. Once attackers have your encryption key or a foothold, they plant backdoors that survive a basic clean-up, letting them return later to re-infect the store or exfiltrate customer data.
- Vulnerable extensions and integrations. Third-party modules are a common entry point. An out-of-date or poorly written extension can open the whole store, even when Magento itself is patched.
- Weak admin access and brute force. Guessable passwords, no two-factor authentication, and exposed admin URLs let attackers in through the front door without needing a software exploit at all.
The pattern across all of these is speed and automation. Attackers scan continuously, weaponise new vulnerabilities within hours, and target the slowest-patching stores first. Your defence has to be just as systematic.
The single biggest security risk many stores carry is running a version that no longer receives security patches. Magento 1 reached end of life in June 2020 and has had no official security updates since. Any store still on Magento 1 is running on foundations that have been unpatched for years, and it cannot be made PCI compliant. It is a breach waiting to happen.
Magento 2 and Adobe Commerce are not immune to this either. Each version is supported for a limited window, and older 2.4 releases reach end of life on a rolling basis. Once your version is out of support, Adobe stops shipping security fixes for it, so the next critical vulnerability has no patch you can apply. Running a current, supported version is not a nice-to-have, it is the baseline of being secure.
If you are on an unsupported version, upgrading or migrating is the most important security investment you can make. Our guide to Magento migration covers how to move safely, and our Adobe Commerce guide explains the managed, regularly patched option.
Any store that handles card payments must comply with the PCI DSS, the Payment Card Industry Data Security Standard. The latest version, PCI DSS 4.0, became fully mandatory in March 2025, and it added requirements aimed squarely at the skimming attacks plaguing Magento stores.
Two new requirements matter most for eCommerce. One requires you to manage and inventory all scripts running on your payment pages, so a rogue skimmer cannot hide among legitimate code. The other requires you to monitor those pages for unauthorised changes, so tampering is detected quickly rather than after thousands of cards are stolen. In other words, the standard now expects exactly the kind of script control and change monitoring that stops Magecart.
Compliance is not the same as security, but the two now point in the same direction. Meeting PCI DSS 4.0 properly forces good habits, and most of those habits, such as monitoring payment-page scripts and keeping software patched, are the same ones that keep attackers out. Treat PCI as the floor, not the ceiling.
Use this as a working checklist. None of it is exotic; the stores that get breached are almost always the ones skipping the basics.
- Apply Adobe security patches immediately, ideally within hours of release, not weeks.
- Run a current, supported version of Magento or Adobe Commerce; never stay on end-of-life software.
- Rotate your encryption (crypt) key if you ever patched late, in case it was already stolen.
- Enforce strong, unique admin passwords and require two-factor authentication for every admin user.
- Lock down the admin: change the default admin URL, restrict access by IP where possible, and remove unused accounts.
- Audit and update third-party extensions; remove any that are unused, abandoned or out of date.
- Monitor for malware, injected scripts and file changes with a scanner that checks your payment pages.
- Keep secure, off-site backups and test that you can actually restore from them.
- Use a Web Application Firewall and a reputable, security-focused host.
- Meet PCI DSS 4.0, including managing and monitoring the scripts on your payment pages.
Most of this is ongoing work rather than a one-off task, which is why many merchants put it on a managed plan. Our Magento support and secure Magento hosting services handle patching, monitoring and backups so this never slips.
- Magento is heavily targeted: CosmicSting breached over 4,200 stores and 2025’s SessionReaper hit around half of all stores.
- The top threats are Magecart skimmers, critical platform CVEs, stolen crypt keys and backdoors, vulnerable extensions and weak admin access.
- Almost all breaches exploit known, already-patched flaws, so fast patching is the single highest-impact defence.
- Running an end-of-life version, especially Magento 1, leaves you permanently unpatched and unable to be PCI compliant.
- PCI DSS 4.0 now requires managing and monitoring payment-page scripts, directly targeting skimming attacks.
- Security is ongoing discipline, patch, monitor, back up and lock down admin, which many stores run as a managed service.
Magento security in 2026 comes down to discipline. Apply Adobe security patches within hours, not weeks, because mass attacks like CosmicSting and SessionReaper weaponise new vulnerabilities almost immediately. Stay on a supported version, since end-of-life software including Magento 1 can never be made secure or PCI compliant. Rotate your crypt key after any patch delay, enforce two-factor admin authentication, audit extensions, monitor for skimmers and file changes, keep tested backups, and meet PCI DSS 4.0 by managing and monitoring payment-page scripts. Almost every breach exploits a known flaw, so speed and a supported version are the two changes that protect you most.
Common questions about Magento security. Get in touch if yours is not here.
We patch, monitor, host and harden Magento and Adobe Commerce stores so breaches never get the chance. Book a free consultation and we will review where your store is exposed.