# Magento 2 security: patches on time and nothing odd in the checkout.

> Magento 2 and Adobe Commerce security: patches, checkout skimmers and vulnerable modules, reviewed with a read-only module. Report from €169.

URL: https://webintacta.com/en/magento-security
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** A Magento 2 store (Adobe Commerce or Magento Open Source) is a prime target for card-stealing skimmers, and critical flaws like CosmicSting (2024) or SessionReaper (2025) are exploited at scale within days of the advisory. At WebIntacta (Jose Soriano) I review your Magento store from the inside with a read-only module: integrity of the core and its JavaScript, modules and Composer packages with published vulnerabilities, hidden PHP and forgotten backups. The report costs €169, excluding VAT.


Magento is the platform where large-scale card theft (Magecart) was born, and it is still one of its favorite targets. On a Magento store, what removes the most risk is applying Adobe's patches as soon as they come out and knowing whether anyone has touched the code that loads on the payment page.

## What I check on a Magento store

- Exact version (with its `-pN` patch) against Adobe's security bulletins
- Integrity of the core and its JavaScript: an altered Magento file is the typical route for a skimmer
- Enabled modules and `composer.lock` packages matched against published vulnerabilities
- PHP hidden in `pub/media/` and backups like `app/etc/env.php.bak` or dumps in `var/backups/`
- Scripts in the design configuration (header and footer) and in CMS blocks
- `var/log/` logs: repeated fatal errors and database outages

## How I do it

1. **Free external scan.** Magento branch, Adobe advisories, third-party scripts and skimmers visible on public pages, exposed files, headers and email.
2. **Read-only module.** Copied to `app/code/` and enabled with `bin/magento` over SSH (Magento does not install modules from the admin panel). It only answers signed requests.
3. **Report and plan.** A PDF with the grade, the urgent items first (patches and checkout) and what to do with each finding.

## Magento 2 security: what cannot wait

## Adobe's patches, in days rather than months

Adobe publishes security bulletins (APSB) for Adobe Commerce and Magento Open Source several times a year. The critical ones are exploited very quickly: CosmicSting (CVE-2024-34102, June 2024) allowed reading files on the server and, chained with other flaws, running code; SessionReaper (CVE-2025-54236, September 2025) allowed taking over customer sessions. In both cases there were mass attacks against unpatched stores in the following weeks. If you cannot upgrade, Adobe usually publishes an isolated patch you can apply without waiting.

Magento 1 stopped getting patches in June 2020. If your store is still on Magento 1, no report makes it secure: it has to be migrated.

## Where skimmers hide in Magento

- **Design configuration**: Content → Design → Configuration → HTML Head ("Scripts and Style Sheets") and Footer ("Miscellaneous HTML"). It is the favorite spot: a script there loads on every page, checkout included.
- **CMS blocks and widgets** with scripts nobody added.
- **Modified core JavaScript files** in `pub/static/` or in the source code: that is why I compare each file with the original of your version.
- **Modified payment modules**, or modules nobody knows who installed.

How a skimmer works and what to do if you find one is in the guide on [credit card skimming in online stores](https://webintacta.com/en/guides/credit-card-skimming-online-store). If customer data is affected, the GDPR sets deadlines for EU stores: see [data breaches in online stores](https://webintacta.com/en/guides/online-store-data-breach-gdpr).

## Checklist

1. **Version up to date**, with the latest security patch for your branch, and production mode enabled.
2. **A custom admin path** (not `/admin`) and two-factor authentication for every user, which Magento 2.4 ships with.
3. **Admin users reviewed** in System → Permissions → All Users, and **integration tokens** in System → Extensions → Integrations.
4. **No backups or dumps in the public site**, and no `.bak` copies of `app/etc/env.php`.
5. **Cron running**: many cleanup and indexing tasks depend on it.

## If your Magento store is already hacked

If a customer tells you their card was misused after buying from your store, act as if there is a skimmer until proven otherwise: do not delete anything before making a backup, and check the checkout first. Magento malware removal costs from €390, with a fixed quote after the scan, because it depends on the size of the installation and its modules.

## Magento maintenance

I do not have a fixed-price maintenance plan for Magento: patching a Magento store requires a staging environment and depends heavily on its modules. I quote it in writing after the report.

## Price

The store report includes the checkout review and is fully deducted if you order the cleanup within 30 days.

### External scan — Free
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
- Platform and version (WordPress, PrestaShop, WooCommerce, Shopify…)
- Visible plugins and modules with published flaws
- Files that should not be public (backups, .git, configuration files)
- HTTPS, certificate and security headers
- Domain email (SPF, DKIM, DMARC) and blocklists
- AI agent readiness (scored separately)

### Security report · online store — €169 (excluding VAT)
Everything in the website report, plus a review of checkout and the store's modules.

$169 outside the EU.
- Everything in the business website report
- Skimmers: scripts that copy cards at checkout
- Modified overrides and payment modules
- Database: scripts injected into content and settings

> Fully credited if you hire a cleanup or maintenance within 30 days.

### Cleanup of other CMSs or custom PHP — from €390 (excluding VAT)
Joomla, Drupal, Magento or your own code: a fixed quote after the analysis.

From $390 outside the EU.
- A first analysis to define the scope
- A fixed quote before any work starts

For Magento stores outside the EU, the report is $169 and the cleanup from $390.

## Frequently asked questions

### Does it work with Adobe Commerce or only with Magento Open Source?

The module works on Magento 2.4. Core integrity is compared with the published Magento Open Source releases; packages exclusive to Adobe Commerce and third-party packages are not judged as core, but they are matched against published vulnerabilities.

### I do not have SSH access. Can you still do the review?

Yes. Without SSH the module cannot be enabled, but I can use a temporary agent uploaded by FTP to the Magento root that expires after 72 hours and deletes itself.

### Can the module see my customers' data or orders?

No. It sends versions, file fingerprints and metadata, plus the contents of the code files I ask for; never `env.php`, nor backups or database dumps. It changes nothing.

### How much does Magento malware removal cost?

It costs from €390, excluding VAT, with the price agreed in writing after the scan.

Hire or ask (email and chat): https://webintacta.com/soporte?lang=en