Скачать или смотреть MM24NYC - CosmicSting and the Power of the Magento Community Response - Vitaliy Golomoziy - Bemeir

June 2024 was one of the most dramatic months in Magento history due to the unprecedented security vulnerability(ies) that were discovered by Sansec and were exploited on a massive scale.

In this talk we discuss what the CosmicSting attack is, how it affected Magento and the necessity to rotate an encryption key as a result. This necessity to rotate a key shocked the whole Magento ecosystem and unveiled the robustness and power of the open-source model and strength of the ecosystem which happened to identify the critical problem in Magento core functionality and find a solution within hours, long before the official vendor managed to come up with any official reaction.

We will explain in detail the challenge with key rotation, how encryption works in Magento, and our solution to alleviate the threat.