Mirasvit Vulnerability Exploited to Execute Code on Magento Servers
Source SecurityWeek
Mentioned vulnerabilities
Fixed in 1.11.12 : update affected systems when convenient.
Data as of 4 Jun 2026, 22:13 UTC
Rated by Threat Radar
- Patch
- Available – fixed in 1.11.12
What to do
AI-suggested
A patch is available in Mirasvit Cache Warmer extension version 1.11.12 and later. Organizations should immediately update to this version to remediate the vulnerability. CISA mandates federal agencies to patch within three days. Administrators can monitor for exploitation attempts by checking for CacheWarmer cookies containing base64-encoded serialized PHP objects starting with Tz, Qz, or YT as indicators of compromise. No other vendor advisories indicate alternative mitigations or that no action is required.
Description
A flaw in the Full Page Cache Warmer extension can be exploited without authentication via serialized PHP object payloads. The post Mirasvit Vulnerability Exploited to Execute Code on Magento Servers appeared first on SecurityWeek .