Top all-time · #4422
Sansec
Company blog · sansec.io/researchsecurity
Sansec is the company blog at sansec.io, writing about security. Since 2020, 16 different Hacker News readers have linked it 20 times, most often “Backdoor found in popular ecommerce components”. It is still writing: the last post was on 2026-10-26, and you can follow it by feed.
Too few sampled comments (6) to say how often HN recommends it.?
Why HN links it
HN readers link Sansec's research posts on malware and supply-chain attacks, such as CronRAT, the polyfill.io attack and Adobe Commerce vulnerabilities, mostly as sources in security discussions.
Summarised by Claude from a sample of 6 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Use Sansec eComscan to discover all malware & vulnerabilities in your online store. Supports Magento, Adobe Commerce, WooCommerce, Shopware, Sylius and m...
Most-linked posts?
- Backdoor found in popular ecommerce components3 people · 3 mentions · first linked 2025-05-05
- CronRAT malware hides behind February 31st3 people · 3 mentions · first linked 2021-11-26
- Polyfill supply chain attack hits 100K+ sites2 people · 2 mentions · first linked 2024-06-25
- NginRAT Parasite Targets Nginx2 people · 2 mentions · first linked 2021-12-05
What Hacker News says?
I'm going to engage only because I do not wish others to come across this project and think it's serious. I did open the project and read the code, and I did throw it into an LLM as I previously said for some very basic security posture checks, and found a number problems immediately, but I don't trust them (and neither should you, which is part of the problem here), so I went digging a bit deeper. I don't have the…
Comment linking /research/php2shell
on “PHP 8.2.35”Submitted Polyfill supply chain attack hits 100K+ sites as a story · 887 points
HN discussion> We've just shifted from "quiet, persistent threat" to "hacker announces to the world that he's in". Changing javascript on a prod website is going to trigger alarms. While I'd like that to be true, it really isn't. There have been loads of card skimming operations injected into production sites which weren't noticed for sometimes months.[0][1][2][3] [0]: https://blog.malwarebytes.com/hacking-2/2020/03/criminals-ha…
Comment linking /research/svg-malware
on “Using HTTP Basic Auth in 2022”Submitted CronRAT malware hides behind February 31st as a story · 65 points
HN discussionCan confirm. I work at an e-commerce agency where we work with (among others) Adobe Commerce. The number of unauthorized RCE vulnerabilities being reported not only in the core product, but also very popular modules used in the community[1] is going through the roof. And we are having a lot of close calls, too; just last weekend, a 0day[2] was widely being exploited at a large scale, before any publication or patch.…
Comment linking /research/stylesmuggler-0day
on “We have a year to fix security everywhere”Submitted Backdoor found in popular ecommerce components as a story · 45 points
HN discussionIf you're wondering why: https://sansec.io/research/polyfill-supply-chain-attack
Comment linking /research/polyfill-supply-chain-attack
on “uBlock Origin has blocklisted PolyfillIO in it's badware list”Submitted NginRAT Parasite Targets Nginx as a story · 9 points
HN discussion> That github link refers to a better write-up https://sansec.io/research/cronrat (which the bleepingcomputer article rehashes, because hey, this is 2021 and ad views is the goal...). I looked through that one also, no mention about how the bash script is executed.
Comment linking /research/cronrat
on “New Linux malware hides in cron jobs with invalid dates”Submitted Backdoor found in popular ecommerce components as a story · 6 points
HN discussionThat github link refers to a better write-up https://sansec.io/research/cronrat (which the bleepingcomputer article rehashes, because hey, this is 2021 and ad views is the goal...). > CronRAT’s main feat is hiding in the calendar subsystem of Linux servers (“cron”) on a nonexistant day. This way, it will not attract attention from server administrators. And many security products do not scan the Linux cron system. I…
Comment linking /research/cronrat
on “New Linux malware hides in cron jobs with invalid dates”Submitted Claude finds 353 zero-days on Packagist as a story · 4 points
HN discussionSubmitted The billion-dollar security.txt problem as a story · 4 points
HN discussionSubmitted Backdoor found in popular ecommerce components as a story · 4 points
HN discussionSubmitted NginRAT Parasite Targets Nginx as a story · 3 points
HN discussionSubmitted OptinMonster supply chain attack hits 1.2M WordPress sites as a story · 1 points
HN discussionSubmitted Magecart skimmer turns Stripe into a malware command server as a story · 1 points
HN discussionSubmitted Building a faster YARA engine in pure Go as a story · 1 points
HN discussionSubmitted Cardbleed: Magento 1 Card Skimming Attack as a story · 1 points
HN discussion
