How to check your Adobe Commerce or Magento store for hidden scripts
In plain English
Security researchers at Sansec report finding unwanted scripts on 953 online stores, most running Magento Open Source or Adobe Commerce, many of which had missed recent security updates. The scripts were hidden inside the stores' content blocks, which makes them harder for standard scans to spot.
Why it matters
Installing the latest patch closes the gap, but it won't remove anything added before the update. A quick check alongside patching makes sure your store is clean.
What to do
- 1Check content blocks for unexpected scriptsYour developer
Ask your developer to look through your CMS blocks and pages for any scripts you didn't add. Sansec found the code hidden there, where standard scans can miss it.
- 2Remove admin users you don't recogniseYour developer
Review every admin account and delete any that aren't yours or your team's. Ask everyone else to change their passwords.
- 3Make sure all security patches are installedYour developer
Patching closes the gap but won't remove anything already added, so do both: patch, then check.
- 4Consider a specialist security scanYour developer
If you're unsure, a Magento-specific security scan can look for hidden scripts that general tools miss.
Found by our AI agent and checked by Peter Screeton, Founder of Create8. He confirmed the original source is genuine and that this summary matches what it said when published.