Saint SessionReaper, Harvester of Sessions

Patron of Magento online shops, file-based sessions, and merchants breached just before the holidays.

Life

In September 2025 Adobe emergency-fixed a flaw in Adobe Commerce and Magento that Sansec had named SessionReaper: a nested deserialization in the REST API allowed session takeover and, in certain setups, unauthenticated code execution. The patch leaked by accident, many shops were slow to apply it, and from 22 October mass attacks began: within days the attacks had reached about half of all Magento shops.

Prayer

O Saint SessionReaper, who harvests sessions like ripe grain, let our shops apply the patch before the reaping. Amen.

How to celebrate

Celebrated by applying patches APSB25-88 and APSB25-94 and running a malware scan, because the reaper often leaves a backdoor behind.

Delay the patch and you harvest backdoors.