Big names among thousands infected by payment-card-stealing CosmicSting crooks

A critical unauthenticated XXE vulnerability (CVE-2024-34102, 'CosmicSting') in Adobe Commerce/Magento has been actively exploited since before an official patch, allowing attackers to inject malicious JavaScript into e‑commerce pages to steal payment cards, credentials, and other customer data; Sansec reports roughly 4,275 compromised stores (about 5% of installations), multiple criminal groups running automated campaigns and published IoCs, and risk of persistent backdoors if combined with a separate glibc/PHP flaw (CVE-2024-2961).