Magento: campaign infects 953 stores

Magento

A Magento skimmer campaign infected 953 online stores, using five domains and bot filtering.

Do this now

Upgrade Magento to 26.02.0 and check your store for skimmer code from this campaign.

Fix it

Upgrade to Magento 26.02.0

Also affects (downstream advisories): gpac gpac. Check those vendors' own fixes.

First seen: 26 Oct 2026
Last update: 26 Oct 2026, 22:18 UTC
Fixed in: 26.02.0
Identifiers: CVE-2025-60467
CVSS: 7.5
Source: news
On the menu as: Magento

Check this repository for exposure to one security incident from pwned.coffee. Report first, change nothing until I say so.

## Magento: campaign infects 953 stores
Severity: high. Patch status: patched.
Affected: Magento
Fixed in: 26.02.0
Ids: CVE-2025-60467

A Magento skimmer campaign infected 953 online stores, using five domains and bot filtering.

## Steps
1. Search the repo, its CI and infra config for Magento. If present, report the version in use and whether it's affected.
2. Fix by release line: Magento: 26.02.0.

## Fix by release line
| Line | State | Fix | Until then |
|---|---|---|---|
| Magento | fixed | 26.02.0 | — |

## Report
A table: file, product or package, version in use, affected yes/no, exact fix. Then anything a human has to check outside the repo.

If you have the pwned.coffee MCP server (https://pwned.coffee/mcp), call lookup_cve("CVE-2025-60467") for the latest, and check_repo with this repo's lockfiles, Dockerfiles and workflows for a full receipt.
Sources: https://securityaffairs.com/201795/malware/magento-campaign-infects-953-online-stores-across-five-domains.html https://seclists.org/oss-sec/2026/q4/395
https://pwned.coffee/i/magento-campaign-infects-953-stores

Timeline

26 Oct 2026, 22:18 UTC
Fix status: unknown → patched.
26 Oct 2026, 22:17 UTC
New CVE-2025-60467 assigned to the GPAC/MP4Box use-after-free vulnerability.
26 Oct 2026
First reported.

Receipt

Exploitation: No known exploitation
Fix by release line: Product Affected Fixed in Source
Magento before 26.02.0 26.02.0 CVE record (CNA) checked 26 Oct
Score: CVSS 7.5 (high). CVSS 3.1 7.5 (CISA ADP) for CVE-2025-60467
Last checked: 26 Oct 2026, 22:18 UTC

Product	Affected	Fixed in	Source
Magento	before 26.02.0	26.02.0	CVE record (CNA) checked 26 Oct

Sources: KEV – CVE record ✓ Vendor ✓

Sources

Wrong fix version, or a source we missed? Send it back to chef@pwned.coffee with the source, and we'll correct it here.

Totalone hot coffee