“SessionReaper” Harvests Roots: Mass Exploitation Campaign Hits Over 200 Magento Sites

Oasis Security warns of a critical Magento vulnerability (CVE-2025-54236, "SessionReaper") that enables attackers to reuse "zombie" session tokens to bypass authentication and gain root-level control; an active mass exploitation campaign has been observed with hundreds of compromised storefronts, web shells deployed for persistence, and associated C2 infrastructure (notably IP 93.152.230.161). Approximately 1,460 Magento Commerce APIs were identified as vulnerable, and administrators are urged to patch immediately to prevent further full-system compromises.