CosmicSting (CVE-2024-34102) let attackers steal a Magento store's secret key without logging in, then copy customers' card details at checkout. Sansec counted 4,275 stores hacked. Here's what happened, why patching alone wasn't enough, and what it means for your store.
If you run an online store, the most valuable thing on your website isn't your product catalogue. It's the card details your customers type in at checkout, and the trust that makes them willing to type them.
In 2024, a single flaw in Adobe Commerce and Magento Open Source, nicknamed CosmicSting, let attackers reach into thousands of stores and quietly add code that copied those card details as customers entered them. No password was needed. And for many stores, installing the official fix was not enough to get the attackers out.
CosmicSting is now more than two years old, but the way it unfolded is a clear lesson for any business running an e-commerce platform it doesn't actively keep up to date.
How one flaw let attackers steal card details at checkout
Every Magento store has a secret encryption key, a kind of master password the store uses to prove that requests to its own systems are genuine. CosmicSting gave attackers a way to read that key from the store's configuration files, without logging in.
With the key in hand, an attacker could pretend to be a trusted part of the store's own system. Researchers at the e-commerce security firm Sansec documented what came next: attackers used that trusted access to edit content blocks that appear on every page, including checkout, and placed a card skimmer inside them. A card skimmer is hidden code that copies payment details as a customer types them and sends them to the attacker. To the customer, the checkout looked normal.
Sansec also reported that at least one group combined CosmicSting with a separate technique to run its own code on the server itself, going beyond the store's pages.
The timeline shows how quickly things moved. On 11 June 2024, Adobe published a security update that fixed the flaw, rated it critical at 9.8 out of 10, and noted that it could be exploited without logging in. Adobe first gave the update its lowest urgency rating. It raised that rating twice in the following weeks as details became public, and now states: "Adobe is aware that CVE-2024-34102 has been exploited in the wild in limited attacks targeting Adobe Commerce merchants." The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalogue of Known Exploited Vulnerabilities on 17 July 2024.
Sansec tracked the fallout. In July it reported stores "getting hacked at a rate of 5 to 30 per hour". By 1 October 2024 it reported that "seven different groups have been hacking into 4275 online stores", which it estimated at 5% of all Adobe Commerce and Magento stores. It named National Geographic, Segway, Ray-Ban and Cisco among the victims.
What could go wrong for your business
For an online retailer, a flaw like this goes straight to the heart of the business:
- Customers' cards stolen from your site. A skimmer at checkout means your customers' payment details are taken while they buy from you.
- Investigations and clean-up costs. Working out what happened, removing malicious code and securing the store takes time and specialist effort, on top of fixing the original flaw.
- Lost customer trust. Shoppers who learn their card was compromised on your site may not come back, and word travels.
- Payment and compliance consequences. Card data is tightly regulated, and a breach at checkout can bring questions from your payment providers and obligations to notify affected customers, depending on where you trade.
- Disruption to sales. Taking a store offline to investigate, or rebuilding it, interrupts revenue.
These are realistic consequences, not certainties for every store. But CosmicSting showed that they can reach businesses of every size, including well-known brands.
Could your website be next?
CosmicSting is a clear example of how modern attacks work. Attackers didn't research each store individually. They used automated tools to scan the internet for Magento stores that hadn't applied the fix, and broke into whichever ones they found. According to Sansec, 75% of stores still hadn't patched on 18 June 2024, a week after the fix was released, and that is why so many were exposed when automated attacks began.
A small or little-known store had no special protection. It only needed to be online and running an affected version. Seven competing groups were working through the same pool of vulnerable stores.
The less obvious lesson is about time. If an attacker had already read your secret key, installing the fix closed the hole but left them holding a working key. Sansec warned that "Merchants that are currently still vulnerable should consider their encryption key as compromised", and that rotating the key alone was "necessary but not sufficient". A store that patched late, and saw nothing unusual, could not assume it was clean.
No incident so far doesn't mean safety. The next flaw of this kind will be scanned for in the same way.
Why legacy PHP applications deserve attention
CosmicSting wasn't a flaw in the PHP language, and a store on a supported release that could update quickly was able to install the fix the day it came out. The damage came from how long many stores took.
Upgrades are rarely simple. Magento upgrades often break themes, payment modules and custom extensions, so many stores put them off and fall behind.
Quick fixes have limits. Adobe released a standalone fix for stores that couldn't upgrade quickly, but it was listed for versions 2.4.4 to 2.4.7 only. Stores on older releases had to upgrade first. The further a store has drifted from a supported version, the fewer shortcuts it has.
Support runs out. According to Adobe, regular support for Magento 2.4.4 ended on 12 April 2025, for 2.4.5 on 12 August 2025 and for 2.4.6 on 11 August 2026. Adobe lists extended support periods for those lines, but they end too. Stores still on Magento 1, which Adobe stopped supporting in 2020, get no official security fixes at all.
The same kind of flaw can appear on any technology, Node.js included. What protects a store is a platform the team can update quickly and secrets that can be changed without drama.
What this means for your organisation
If your business runs a Magento store, especially an older one, ask:
- Which exact version are we running, and is it still supported?
- When did we install the CosmicSting fix, and if it was late, was anything done beyond installing it?
- How long does it take us to apply an urgent security update, days or months?
- Who would notice if something changed on our checkout page?
If the answers are uncertain, the store deserves a closer look. A platform you can't update quickly is a business risk in its own right.
Recommended next step
Don't wait for a payment provider or a customer to tell you something is wrong at checkout. Our free Legacy PHP assessment looks at the areas CosmicSting exposed: your platform version, your extensions, your hosting and how your store's secret keys are managed. It is designed to give you a clear picture of potential security concerns, maintenance challenges and modernisation opportunities.
We'd then be glad to discuss what we find with you. For some stores, the right step is to get Magento current and keep it that way. For others, a move to the modern Node.js stack, which Sketchmonk builds on, may suit the business better, depending on the store's requirements and goals. No platform is immune; the aim is a store you can patch in days, not months.
Understand your risk before an incident forces you to.
Free Legacy PHP Risk Assessment
Running a Magento or other PHP-based store? We'll review your platform version, extensions, hosting and key management, and tell you plainly where you're exposed and what your options are, whether that's a patch, an upgrade or a migration.
