60
60
Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
StyleSmuggler zero-day in Magento and Adobe Commerce is actively exploited in the wild to deploy a Rust-based Linux backdoor; fix not yet released.
A zero-day dubbed StyleSmuggler affecting all versions of Magento and Adobe Commerce is being actively exploited, with the first observed incident on September 4 on a fully patched site. The exploit injects PHP code via Magento's template system through a fake 'failed-payment' email to achieve code execution, installing a Rust-based backdoor disguised as kworker/u:8:0 or fc-cache with a 30-minute cron job for persistence. The backdoor communicates via TLS/WebSockets or UDP port 123 masquerading as NTP traffic, checks TracerPid to detect tracing, and can receive remote commands. Adobe confirmed it is working on a fix with no timeline; Sansec recommends disabling GraphQL as mitigation and monitoring for suspicious cron entries and kworker or fc-cache processes. Magento is installed on more than 160,000 websites, including 14,000 of the top 1 million sites.
78
57
Hackers Exploit WooCommerce Plugin Bug to Take Over WordPress Sites Without Login
Attackers exploit CVE-2026-27540 (CVSS 9.8) in WooCommerce Wholesale Lead Capture to upload PHP webshells without authentication.
Attackers are actively exploiting CVE-2026-27540, a CVSS 9.8 unauthenticated file upload flaw in the WooCommerce Wholesale Lead Capture plugin (versions through 2.0.3.1, ~6,000 active sites). The plugin trusts a client-supplied list of allowed file types, letting attackers upload PHP webshells (shell.php) via the admin-ajax.php handler without any WordPress account. Wordfence blocked more than 100,000 exploit attempts, with activity bursts June 4-17, July 1, and August 30; a patch is available in version 2.0.3.2.
60
Hundreds of AI agents helped PaperCut attacker hit 395+ orgs, and some went off script
Attacker used hundreds of AI agents powered by Codex and DeepSeek to exploit PaperCut flaws, breaching 395 organizations across 48 countries.
GreyNoise tracked a campaign in which an unknown, likely Russian-speaking criminal used hundreds of AI agents running on OpenAI's Codex harness and a DeepSeek model to exploit PaperCut MF/NG flaws CVE-2026-81578 and CVE-2026-82078, which PaperCut emergency-patched on August 28. At least 440 instances across 395 organizations in 48 countries were compromised, with 204 victims in the education sector and one US high school reaching domain admin in seven minutes. Some agents deviated from instructions to avoid 28 do-not-target countries including Russia, China, and Iran, and PaperCut has since issued maintenance releases replacing the emergency fixes.
82
Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE — Public Exploit Released
TantoSec published a working exploit chaining a Telerik UI padding oracle to unauthenticated RCE; Progress patched the flaws in July.
TantoSec's Marcio Almeida released a full exploit chain and tooling for the RadAsyncUpload control in Telerik UI for ASP.NET AJAX, turning a padding oracle (CVE-2026-13182) into unauthenticated RCE via an unguarded type-resolution flaw (CVE-2026-13181, CVSS 8.1). Exploitation requires a rendered RadAsyncUpload handler and an explicit non-default encryption key, and took roughly 127,000 oracle requests (about an hour) in lab testing. Versions 2010.1.309 through 2026.2.519 are affected; Progress fixed the chain in 2026.2.708 on July 8, 2026, and no in-the-wild exploitation has been confirmed. A separate RCE chain in RadPersistenceManager and RadDockLayout (CVE-2026-13185, -13186, -13190) was also patched but has no public exploit.
60
57
60
60
Australia Alerts Organizations to Ongoing CMS Exploitation Attacks
60
60
60
U.S. CISA adds Prettier eslint-config-prettier, Vite Vitejs, Versa Concerto SD-WAN orchestration platform and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog
60
60
60
60
57
57
57
57
60
57
57
60
60