UPDATE: Cybersecurity researchers have identified a novel exploit targeting Magento websites, utilizing a critical vulnerability. Magento is a platform with built-in PHP, which helps users to create eCommerce websites. Adobe characterized this vulnerability, tracked as CVE-2024-20720 (CVSS score of 9.1/10), as an improper neutralization of special elements issue, which could lead to arbitrary code execution if exploited. The flaw was patched in updates issued on February 13, 2024. The exploit involves a sophisticated attack where a malicious layout template inserted into the database automatically injects code, enabling attackers to execute system commands via the Magento layout parser and the beberlei/assert package. This method triggers when the checkout cart page is accessed, deploying a backdoor for code execution and installing a Stripe payment skimmer to steal financial data. The discovery coincides with the Russian government charging six individuals for deploying skimmer malware to pilfer credit card details from international e-commerce platforms since late 2017, leading to the illegal acquisition and sale of information from nearly 160,000 payment cards. CTIX analysts recommend that all Magento users ensure they have installed the latest update to prevent future exploitation.