Magento E-commerce sites affected by Exploit

Description of the Magento Exploit

Recently, a critcial vulnerability consisting of a chain of vulnerabilities has been discovered within the community and enterprise editions of Magento. A patch was released in February which addressed this issue, but as of this month 98,000 merchants had not installed this patch. The vulnerability allows attackers to create administrator accounts within unpatched Mageneto sites. This gives the attacker access to credit card information and administrative access to the Magento system.

Location of Patch and Instructions

If you are using Magento, make sure to apply the update as soon as possible. Installation instructions can be found here.

For more details on this alert, please see the Ars Technica article.