60
60
BlackOasis APT leverages new Flash zero
60
Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
StyleSmuggler zero-day in Magento and Adobe Commerce is actively exploited in the wild to deploy a Rust-based Linux backdoor; fix not yet released.
A zero-day dubbed StyleSmuggler affecting all versions of Magento and Adobe Commerce is being actively exploited, with the first observed incident on September 4 on a fully patched site. The exploit injects PHP code via Magento's template system through a fake 'failed-payment' email to achieve code execution, installing a Rust-based backdoor disguised as kworker/u:8:0 or fc-cache with a 30-minute cron job for persistence. The backdoor communicates via TLS/WebSockets or UDP port 123 masquerading as NTP traffic, checks TracerPid to detect tracing, and can receive remote commands. Adobe confirmed it is working on a fix with no timeline; Sansec recommends disabling GraphQL as mitigation and monitoring for suspicious cron entries and kworker or fc-cache processes. Magento is installed on more than 160,000 websites, including 14,000 of the top 1 million sites.
78
60
60
60
60
60
60
60
60
60
60
57
CISA Adds 4 Actively Exploited Adobe, Joomla, and Langflow Flaws to KEV
60
CISA Adds 6 Known Exploited Flaws in Fortinet, Microsoft, and Adobe Software
60
SessionReaper attacks have started, 3 in 5 stores still vulnerable
60
60
June 2021 Patch Tuesday: Microsoft fixes six actively exploited zero-days
60
December 2019 Patch Tuesday: Microsoft fixes one actively exploited zero-day
60
BlackOasis APT and new targeted attacks leveraging zero
60
60
60
60
45
Microsoft fixes zero-day exploited for cyber espionage (CVE-2025-33053)
60
January 2021 Patch Tuesday: Microsoft plugs Defender zero-day RCE
60
Microsoft addresses three Windows issues actively exploited
60
December 2018 Patch Tuesday: Microsoft patches Windows zero-day exploited in the wild
60
60
57
45
60
60
Microsoft Patches 5 Zero-Day Vulnerabilities Being Exploited in the Wild
60
60
60
StyleSmuggler: The Magento Zero-Day Behind New Store Attacks
Sansec reports actively exploited Magento/Adobe Commerce zero-day StyleSmuggler enabling unauthenticated RCE and Rust backdoor installation on fully patched stores since September 4.
Sansec discovered StyleSmuggler, an unpatched zero-day in Magento Open Source and Adobe Commerce, affecting all current versions including 2.4.7, 2.4.8 and 2.4.9, with attacks observed since September 4. The two-stage attack poisons Magento's template system via the styles property and executes the injected PHP during 'Payment Transaction Failed Reminder' email rendering, working even when email delivery fails and when sessions are moved to Redis. Successful compromise installs a lightweight Rust backdoor disguised as fc-cache or chronyd that beacons every 60 seconds with 48-byte UDP packets to NTP port 123 at ntp.timesync.to. A second attacker deployed a PHP web shell in product-image cache directories, hidden behind 404 responses unless a correct X-Cache-Token header is present.
85
60