01
Security
Convertr analytics script hijacked to skim shoppers' card data
Shoppers who paid by card on affected Convertr-powered stores since October 24 are advised to contact their banks and clear browser caches.
Shoppers who paid by card on affected Convertr-powered stores since October 24 are advised to contact their banks and clear browser caches.
Millions of PHP services remain exposed until operators move to the fixed releases, which federal agencies were ordered to apply by October 29, 2026.
The attacker hides the malicious code from security scanners, so affected store owners need to check their CMS blocks and admin accounts directly.
Operators running any unpatched PHP since version 5.4 are exposed, and the advisories say updating and restarting every worker is the only safe fix.
Affected servers need patches for a PHP bug, and some certificates from one authority may still be trusted by a macOS utility.
Adobe has issued a fix, and merchants on affected versions need to update to close a path to code execution.