Back to Research blog

Uncovering Critical Vulnerabilities in Magento: A Deep Dive

Share on social

August 21, 2024

Lorem ipsum

Table of Contents

Overview

Co-hosts Michael Gianarakis and Shubham Shah reflect on the six-year milestone of Assetnote and do a deep dive into critical Magento vulnerabilities.

They explore the importance of proactive and reactive security research, the limitations of traditional vulnerability scoring systems like CVSS and EPSS, and the significance of understanding exploitability in assessing vulnerabilities.

Shubham Shah

Author

Shubham Shah

Chief Security Research Officer at Searchlight Cyber

Shubham Shah is Chief Security Research Officer, having joined Searchlight Cyber following the acquisition of Assetnote, where he was Co-Founder and CTO. Shubham leads the global security research team whose findings feed directly into Searchlight Exposure – surfacing zero-day vulnerabilities in the tools organisations rely on, often months ahead of public disclosure. He remains a prolific bug bounty hunter ranked in the top 50 hackers on HackerOne, and has presented at various industry events including QCon London, Kiwicon, AusCert, BSides Canberra, and CrikeyCon.

Michael Gianarakis

Author

Michael Gianarakis

CEO at Searchlight Cyber

Michael Gianarakis is CEO of Searchlight Cyber, a leader in premptive cybersecurity. With over a decade in the security industry, Michael has built and led offensive security teams across Asia Pacific and Japan. In 2018 he co-founded Assetnote, a pioneering attack surface management platform acquired by Searchlight Cyber in 2025 – bringing best-in-class ASM capability into the PTEM platform. Michael is a respected security researcher and has presented at DEF CON, Black Hat Asia, BSides Las Vegas, Hack in the Box, AusCERT, Thotcon, 44Con, and OWASP.

Explore related Content

Research

Exploit brokers pay $500,000 for a WordPress RCE. I found one with GPT5.6 Sol Ultra and $25

July 20, 2026

Research

wp2shell: Pre Authentication RCE in WordPress Core

July 17, 2026

Research

Smashing the ServiceNow Sandbox – Pre Authentication RCE

July 14, 2026

Research

CargoWise WebTracker – The Keys Were in the Cargo

June 25, 2026

Research

Two Bypasses for Chrome's Sanitizer API

May 22, 2026

Research

Keys to the Kingdom: Anonymous SQL Injection in Drupal Core (CVE-2026-9082)

May 21, 2026