Sansec
sansec-research · B · active
Primary research firm for Magecart and e-commerce skimming campaigns (added 2026-05-17). Surfaced by S3 sub-agent during FunnelKit/WooCommerce active-exploitation pivot; Sansec confirmed the unauthenticated checkout-endpoint injection on FunnelKit Funnel Builder (cited in 2026-05-17 brief § 1). Industry standard for WordPress/Magento/PrestaShop skimmer disclosures. Candidate; promote to active after 3 runs with content contribution. | 2026-06-20 full audit (v2.62): live, drill=Y. CANONICAL Sansec entry (duplicate id `sansec` consolidated here). FETCH → webfetch https://sansec.io/research then drill per-article; Magecart / JS-supply-chain forensics, frequently first on CDN-compromise campaigns. Promoted candidate→active; +vulns; MEDIUM→HIGH. | 2026-07-05 admiralty audit: B, independent eCommerce-security lab, first-hand skimmer/supply-chain forensics; live and drillable. Status stays active. | 2026-09-29: /research listing is newest-first but carries no inline dates (probe read stray 2020-07-01). Working recipe = feed https://sansec.io/atom.xml 15 (advertised via <link rel=alternate atom> in the page head; dated, newest 2026-09-16), then extract https://sansec.io/research/<slug> for the body (frontmatter date + tags incl. CVE/APSB ids). Use rss fetch_method, keep url as the human page. (2026-09-29T2134Z-audit) | 2026-10-16 BlockStrap analysis (2026-10-15) read with `extract` and used as an update to the Adobe October entry.
Cited in 11 entries
Citation cadence
Citation days per ISO week (25 weeks of coverage span, total 10).
- CVE-2026-48356 (PolyShell), Adobe Commerce and Magento Open Source: an unauthenticated file upload attacked since March 2026, fixed for supported lines in July, and listed by CISA as exploited on 2026-10-272026-10-28
- CVE-2026-109618 / CVE-2026-109619, PHP (PHP2Shell): two unauthenticated remote-code-execution flaws in the runtime, fixed on 2026-10-21 in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, with attack traffic already observed and no upstream release for 8.1 and older (CVSS 4.0 9.2)2026-10-21
- Adobe October 2026 bulletins: unauthenticated CVSS 9.0 to 10.0 flaws, most leading to code execution, in ColdFusion (APSB26-144), Experience Manager (APSB26-152) and Commerce and Magento (APSB26-153), none reported exploited2026-10-14
- Brevo: a stolen Cloudflare API key let an attacker rewrite Brevo pages and widget scripts at the CDN edge, serving ClickFix malware and a WordPress backdoor plugin2026-09-18
- CVE-2026-75650 ("StyleSmuggler"), Magento/Adobe Commerce: unauthenticated CVSS 10.0 RCE via template-engine injection, exploited three days before Adobe's hotfix existed2026-09-08
- CVE-2026-71362, Adobe Commerce and Magento Open Source: an unauthenticated attacker switches a customer session to another customer's account (CVSS 9.1), and a WAF vendor reports it is already blocking attempts2026-08-16
- WordPress supply-chain compromise via Awesome Motive's CDN backdoors ~1.2M sites2026-06-16
- Magecart family runs its skimmer out of Stripe, payload in customer metadata, stolen cards exfiltrated back through api.stripe.com2026-06-07
- CVE-2026-45247, Mirasvit Full Page Cache Warmer (Magento 2 / Adobe Commerce): unauthenticated PHP object-injection RCE, now in CISA KEV2026-06-04
- CVE-2026-10611, MISP: OTP bypass when LDAP mixed-auth and OTP enforcement are both enabled2026-06-04
- FunnelKit Funnel Builder for WooCommerce: unauthenticated settings write (CVE-2026-47100) exploited to plant card skimmers on checkout pages, fixed in version 3.15.0.32026-05-17