October 22, 2015

Magento Malware Alert: The Importance of Patching


Hostway Team

magento-logoOur allies at Magento have passed along the following information for our Magento Merchant customers:

Magento is investigating reports of Magento sites being targeted by Guruincsite malware (Neutrino exploit kit). They have not identified a new attack vector at this time, but have found that nearly all impacted sites tested so far were vulnerable to a previously identified code execution issue for which Magento released a patch in early 2015; sites not vulnerable to that issue show other unpatched issues. The malware can also take advantage of situations where an administrative account has been compromised through weak passwords, phishing, or any other unpatched vulnerability that allows for administrative access, so it is important to check for fake user accounts and for leftover demo accounts.

Magento has posted full instructions for you to identify and fix the Guruincsite issue in the Magento Security Center. They strongly encourage you to immediately do a security health check for your site:

  • Make sure that you have deployed all recent security patches
  • Review admin users on your system and remove any that you do not recognize
  • Check for malware or other vulnerabilities using magereport.com, a useful community project that is not affiliated with Magento

Hostway strongly recommends keeping your mission-critical applications updated to latest versions and patched for all ongoing security concerns.

Stay in the Loop

Join Our Newsletter

Stay ahead of the pack with the latest news, web design advice, and digital insights, delivered straight to your inbox.
This field is for validation purposes and should be left unchanged.
© Copyright 2021 Hostway. All rights reserved.