ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “online stores”

178 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllMalware 735Data breach 723Ransomware 558Vulnerability 479Phishing & fraud 440Policy & legal 316Industry 237Threat actor 200Exploit / PoC 179Research 62AI industry 25AI safety & security 23AI tools & infra 23Advisory 22
SeverityAllcritical 975high 1351medium 896low 741info 84

Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Sansec found attackers exploiting an Adobe Commerce/Magento zero-day (StyleSmuggler) since September 4 to deploy Rust backdoors on online stores.

Threat actors are actively exploiting a zero-day RCE in Adobe Commerce and Magento 2.4.7-2.4.9, injecting PHP code via generated failure reports and executing it through Magento's payment-failure email, with no user interaction required. Exploitation began September 4 and succeeds even against stores running the July and August 2026 patches; the Rust backdoor disguises itself as kworker/u:8:0 or fc-cache and hides C&C communication inside fake NTP replies. Adobe's September 8 Patch Tuesday updates may not include a StyleSmuggler fix.

SecurityWeek · 9d agoExploit / PoC in the wild

Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Sansec reports active exploitation of an unpatched zero-day, dubbed StyleSmuggler, in Magento and Adobe Commerce, letting attackers backdoor online store servers without authentication.

Sansec disclosed on September 5 that attackers are exploiting an unpatched vulnerability, named StyleSmuggler, in Magento Open Source and Adobe Commerce to achieve unauthenticated remote code execution, with attacks observed starting September 4. All current versions including 2.4.9 are affected, and Adobe has published no advisory, CVE, patch, or workaround, with the next scheduled security release on September 8. Hosting firm Disrex Group independently confirmed two compromised stores (running 2.4.8 and 2.4.7-p2), both breached within the roughly eight-hour window before Sansec's blocking rules went live. The implant is a ~1.9 MB statically linked Rust binary disguised as a Linux kworker process, re-adding a cron entry every five minutes and in one case reading Magento sessions directly from Redis with no outbound traffic.

The Hacker News · 10d agoExploit / PoC in the wild

Adobe Commerce max-severity bug comes under active attack

Attackers are actively exploiting CVE-2026-75650 (CVSS 10.0), an unauthenticated RCE zero-day in Adobe Commerce/Magento, deploying a Rust backdoor on e-commerce servers.

Sansec identified active exploitation of a CVSS 10.0 zero-day (CVE-2026-75650) in Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9, dubbed StyleSmuggler. The attack abuses crafted style properties in Magento template processing to execute PHP while rendering a 'Payment Transaction Failed Reminder' email, then launches a Rust backdoor connecting to C2 at 99.84.67.186 disguised as NTP traffic. Exploitation began September 4, 2026; Adobe released emergency hotfix VULN-393411, but Sansec also observed a second attacker deploying a PHP web shell in the product-image cache.

CSO Online · 8d agoExploit / PoC in the wildCVE-2026-75650

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker News · 9d agoExploit / PoC in the wildCVE-2026-85046CVE-2026-86206CVE-2026-86207+7 CVEs

StyleSmuggler: The Magento Zero-Day Behind New Store Attacks

Sansec reports actively exploited Magento/Adobe Commerce zero-day StyleSmuggler enabling unauthenticated RCE and Rust backdoor installation on fully patched stores since September 4.

Sansec discovered StyleSmuggler, an unpatched zero-day in Magento Open Source and Adobe Commerce, affecting all current versions including 2.4.7, 2.4.8 and 2.4.9, with attacks observed since September 4. The two-stage attack poisons Magento's template system via the styles property and executes the injected PHP during 'Payment Transaction Failed Reminder' email rendering, working even when email delivery fails and when sessions are moved to Redis. Successful compromise installs a lightweight Rust backdoor disguised as fc-cache or chronyd that beacons every 60 seconds with 48-byte UDP packets to NTP port 123 at ntp.timesync.to. A second attacker deployed a PHP web shell in product-image cache directories, hidden behind 404 responses unless a correct X-Cache-Token header is present.

Security Affairs · 9d agoExploit / PoC in the wild

MikroTik Patches Critical Flaws Chained to Hack Routers

MikroTik patches six RouterOS flaws; two chained as MikroTrick are actively exploited via SSH to fully compromise exposed routers.

MikroTik released patches for six RouterOS vulnerabilities, including actively exploited MikroTrick chain: CVE-2026-67276 (9.2, SSH auth bypass) and CVE-2026-86060 (9.2, privilege manipulation), plus CVE-2026-67277 (8.8). CERT Poland confirms exploitation since September 2, creating an 'ops' account from IPs 82.192.72.4 and 103.102.31.18. Fixed in RouterOS 7.25beta3, 7.24.2, 7.23.4, and 6.49.21; Shadowserver found 120,000+ SSH-exposed MikroTik devices.

SecurityWeek · 8d agoExploit / PoC in the wildCVE-2026-67276CVE-2026-67277CVE-2026-67278+3 CVEs1

Hackers Actively Exploit Critical WooCommerce Plugin Vulnerability to Upload PHP Backdoors

Attackers actively exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture plugin to upload PHP webshells; patch shipped in version 2.0.3.2.

CVE-2026-27540 (CVSS 9.8) in the WooCommerce Wholesale Lead Capture plugin affects versions 2.0.3.1 and earlier across roughly 6,000 active installations. The unauthenticated AJAX handler wwlc_file_upload_handler trusts a client-supplied file_settings allowlist, letting attackers upload shell.php for remote code execution. Wordfence has blocked more than 100,000 exploit attempts since disclosure, with spikes in June, July, and August 2026. The vendor fixed the flaw in version 2.0.3.2.

GBHackersupdated · 4h agofirst · 1d agoExploit / PoC in the wild 6 sourcesCVE-2026-27540

U.S. CISA adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog

CISA added four actively exploited flaws to its KEV catalog: Magento StyleSmuggler RCE, two Windows privilege-escalation bugs, and N-able N-central RCE.

CISA added CVE-2026-75650 (Adobe Commerce/Magento, CVSS 10.0), CVE-2026-81963 and CVE-2026-85880 (Microsoft Windows local privilege escalation, CVSS 7.8 each), and CVE-2026-86218 (N-able N-central pre-auth RCE, CVSS 10.0) to its Known Exploited Vulnerabilities catalog. Sansec researchers report the StyleSmuggler Magento flaw, actively exploited since September 4, lets unauthenticated attackers run code on vulnerable online stores and deploy web shells and backdoors; Microsoft confirmed active exploitation of both Windows flaws, and N-able shipped an emergency hotfix. Federal civilian agencies must patch the Windows flaws by September 22, 2026, and the remaining entries by September 11, 2026 under BOD 22-01.

Security Affairsupdated · 2h agofirst · 6d agoExploit / PoC in the wild 19 sourcesCVE-2026-75650CVE-2026-81963CVE-2026-85880+1 CVEs1

Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day

Adobe patched over 170 flaws, including in-the-wild zero-day CVE-2026-75650 (CVSS 10) in Adobe Commerce/Magento enabling unauthenticated RCE and web shell deployments.

Adobe released fixes for more than 170 vulnerabilities across Experience Manager, Acrobat Reader, Photoshop and other products. The Commerce zero-day CVE-2026-75650 (CVSS 10) allows unauthenticated code injection leading to remote code execution and has been exploited since September 4. Sansec reported multiple threat actors deploying backdoors and web shells via the bug, dubbed StyleSmuggler, which triggers injected code through Magento's Payment Transaction Failed Reminder email. Adobe also patched critical Campaign Classic command injection CVE-2026-82004 and two critical ColdFusion RCE flaws (CVE-2026-48273, CVE-2026-75746).

SecurityWeek · 8d agoExploit / PoC in the wildCVE-2026-75650CVE-2026-82004CVE-2026-48273+1 CVEs1

N-able Patches Critical Zero-Day in N-central

N-able patches critical unauthenticated RCE zero-day CVE-2026-86218 in N-central, exploited in the wild; on-premises admins must apply hotfix 2026.3 HF4.

N-able released an urgent hotfix (2026.3 HF4) for CVE-2026-86218 (CVSS 10), an unauthenticated RCE in N-central exploited as a zero-day. Scanning/exploitation attempts observed from IP range 23.234.64.0/18 starting September 4; admins should check logs for scanning and unrecognized new accounts. The hotfix supersedes patches for CVE-2026-86206 and CVE-2026-86207, which Huntress observed potentially chained in the wild to bypass authentication in production environments.

SecurityWeek · 8d agoExploit / PoC in the wildCVE-2026-86206CVE-2026-86207CVE-2026-86218