SessionReaper

SessionReaper is the name used for CVE-2025-54236, a critical Adobe Commerce / Magento Open Source vulnerability that has been actively exploited in the wild. The content describes it as an improper input validation issue in the Commerce REST API and, more specifically, as a nested deserialization flaw in admin-facing functionality that enables unauthenticated remote code execution and arbitrary PHP execution. Reported attacker activity included customer account takeover, uploading PHP web shells for persistent access, and reconnaissance using phpinfo() and echo to discover PHP configuration details. Sansec reported more than 250 attack attempts against multiple stores in 24 hours, later stating that mass attacks affected 49% of stores and estimating that 16–18% of Magento stores had one or more backdoors injected. Akamai also observed more than 300 exploitation attempts against over 130 hosts in a 48-hour period from 11 IP addresses. The content attributes exploitation to unknown threat actors rather than a named intrusion set. A reported upload path used in attacks was '/customer/address_file/upload' as a fake session. IPs associated with attacks in the reporting include 34.227.25[.]4, 44.212.43[.]34, 54.205.171[.]35, 155.117.84[.]134, and 159.89.12[.]166. Adobe patched the issue prior to the reported exploitation, and subsequent advisory updates confirmed in-the-wild abuse.