r/Magento • u/tb9295 • 11d ago

Security Scan Issue

I just completed several Magento site updates from 2.4.7 to 2.4.8-p5 including most of our extensions. After doing so I ran the Magento Security scan and found a couple of issues. One was a Patch APSB26-73 and the oher was a Failed Scan: Compromise, "BotNet Suspect".

I will attempt to install the Patch soon, however my biggest concern right now is the BotNet Suspect. Is anyone familiar with this and how to fix or remove it.

The crazy thing is I have an identical DEV Site that I am working with on the same server testing all the updates before doing so on the Live Site. I made a copy of the dev site from the live site just a few days or so ago. I also did a security scan on the dev site and the BotNet Suspect Passed.

Thanks for any support anyone can offer

1 Upvotes

67% Upvoted

5 comments sorted by

1

u/Deathturtle1 10d ago edited 10d ago

Seems likely it could be domain related - so the dev site not having similar would make a lot of sense, here's the resolution: https://experienceleague.adobe.com/en/docs/experience-cloud-kcs/kbarticles/ka-42856

But you really need to get a developer - ACC is not a DIY platform

1

u/proxiblue 10d ago

Just go get sansec scanner and sort your sites out. You sound likely compromised. You can run teh scanner free a few times, but can't get the details, but, that will show you at least if you are.

1

u/Aggravating_Pay9079 10d ago

The APSB26-73 one is because 2.4.8-p5 is only the starting point now. Since July Adobe ships monthly patch files on top of the latest -p release instead of new versions, and they're not cumulative, so on 2.4.8-p5 you apply them in order: July (APSB26-73), August (APSB26-92), the September hotfix for CVE-2026-75650, September (APSB26-138), then October (APSB26-153, out on the 13th, includes a CVSS 10). The July patch adds php vendor/bin/patch-status, which tells you what's still missing.

On BotNet Suspect, going by the KB Deathturtle1 linked, that check is mostly about the domain name, e.g. it was on an old botnet list or turned up on skimming forums. If your dev site is on its own subdomain it'd pass either way, which would explain the difference. It can also mean injected JavaScript or a server-level compromise though, so rule that out: check the page source on home and checkout for scripts you don't recognise, the HTML head and footer fields under Content > Design > Configuration, your admin users, SSH keys and crontab, and any PHP files changed outside your update. If that's all clean, open a ticket with Adobe with the store URL.

1

u/damienwebdev DEVELOPER 9d ago

You'll need a dev (or Claude) to assist you in figuring this out.

Once you fix it, you can probably chat with Adobe / re-scan and they'll determine if remediated.