SUPEE-6137 & SUPEE-2996

[letssewllc]

I got an email about there being these two updates for an SQL injection issue. I was wondering if this was legit because of the email addresses they came from. 

The one for 6137 came from a cqlifoof@magento.com

The one for 2996 came from a avbgzyb@magento.com

I get the feeling that these two emails are not legit. Attached to them is a document called SUPEEFIX.doc and I am hesitant to download it. I am just wanting to know if either of these are legit and not an attempt at the ransomware stuff that has been going around.

[letssewllc]

It keeps happening with different numbers and a different "sender"

[Mukesh Tiwari · Accepted solution]

Hi @letssewllc

Do not download any attachment from these emails. These are for the fake patches which Magento did not  release. All Magento1 patches can be downloaded from https://magento.com/tech-resources/download under release archive section.

[letssewllc]

@Mukesh Tiwari

Thanks, that is what I figured but I just wanted to be 100% sure

[sherrie]

Hi @letssewllc, what @Mukesh Tiwari said is correct. All the patches are available on the downloads page.