ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “Magento Open Source”

23 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllVulnerability 49Exploit / PoC 31Malware 12Ransomware 10Data breach 8Phishing & fraud 3Threat actor 3Advisory 2AI safety & security 1
SeverityAllcritical 81high 24medium 13low 1info 0

Adobe security advisory (AV26-888)

Canada's Cyber Centre warns CVE-2026-75650 in Adobe Commerce and Magento Open Source is exploited in the wild; hotfixes and updates are available.

Canadian Centre for Cyber Security advisory AV26-888 (September 8, 2026) covers CVE-2026-75650 in Adobe Commerce, Adobe Commerce B2B and Magento Open Source. Adobe states the vulnerability is being exploited in the wild. Affected versions extend through the August 2026 patch levels across the 2.4.4-2.4.9 branches, with B2B versions 1.3.x-1.5.x also affected. Administrators are urged to apply the available hotfixes and updates.

Canadian Centre for Cyber Security · 7d agoAdvisory in the wild 2 sourcesCVE-2026-75650CVE-2026-7565

Adobe patches critical Magento account takeover (APSB26-92)

Adobe ships isolated patches (APSB26-92) for Adobe Commerce and Magento Open Source fixing seven flaws, five Critical including account takeover CVE-2026-71362.

Adobe released isolated security patches under APSB26-92 for Adobe Commerce and Magento Open Source addressing seven vulnerabilities, five of them rated Critical. The critical set includes CVE-2026-71362, which Sansec characterizes as enabling account takeover. Merchots running Magento-based stores are urged to apply the patches.

Sansec (Magento / e-commerce security) · Aug 11, 2026VulnerabilityCVE-2026-71362

U.S. CISA adds Microsoft Windows, N-able N-central, and Adobe flaws to its Known Exploited Vulnerabilities catalog

CISA added four actively exploited flaws to its KEV catalog: Magento StyleSmuggler RCE, two Windows privilege-escalation bugs, and N-able N-central RCE.

CISA added CVE-2026-75650 (Adobe Commerce/Magento, CVSS 10.0), CVE-2026-81963 and CVE-2026-85880 (Microsoft Windows local privilege escalation, CVSS 7.8 each), and CVE-2026-86218 (N-able N-central pre-auth RCE, CVSS 10.0) to its Known Exploited Vulnerabilities catalog. Sansec researchers report the StyleSmuggler Magento flaw, actively exploited since September 4, lets unauthenticated attackers run code on vulnerable online stores and deploy web shells and backdoors; Microsoft confirmed active exploitation of both Windows flaws, and N-able shipped an emergency hotfix. Federal civilian agencies must patch the Windows flaws by September 22, 2026, and the remaining entries by September 11, 2026 under BOD 22-01.

Security Affairsupdated · 1d agofirst · 6d agoExploit / PoC in the wild 4 sourcesCVE-2026-75650CVE-2026-81963CVE-2026-85880+1 CVEs1

Magento StyleSmuggler zero-day exploited to deploy Linux backdoor

StyleSmuggler zero-day in Magento and Adobe Commerce is actively exploited in the wild to deploy a Rust-based Linux backdoor; fix not yet released.

A zero-day dubbed StyleSmuggler affecting all versions of Magento and Adobe Commerce is being actively exploited, with the first observed incident on September 4 on a fully patched site. The exploit injects PHP code via Magento's template system through a fake 'failed-payment' email to achieve code execution, installing a Rust-based backdoor disguised as kworker/u:8:0 or fc-cache with a 30-minute cron job for persistence. The backdoor communicates via TLS/WebSockets or UDP port 123 masquerading as NTP traffic, checks TracerPid to detect tracing, and can receive remote commands. Adobe confirmed it is working on a fix with no timeline; Sansec recommends disabling GraphQL as mitigation and monitoring for suspicious cron entries and kworker or fc-cache processes. Magento is installed on more than 160,000 websites, including 14,000 of the top 1 million sites.

BleepingComputer · 8d agoExploit / PoC in the wild

Risky Bulletin: BEC campaign steals €35 million from French notaries

Hackers stole over €35 million from 500+ French notary offices in a four-year BEC campaign; ANSSI spent two years helping evict the attackers.

A business email compromise campaign breached more than 500 French notary offices — about 7% of all French notaries per the Conseil Supérieur du Notariat — over four years, stealing more than €35 million by phishing initial access and silently modifying wire transfer details. France's cybersecurity agency ANSSI worked for two years behind the scenes to help notaries remove the persistent attackers, who had deep access; officials also feared hackers could issue fake notarized acts such as marriage certificates or forged real estate deals. No forged documents have been found so far, but notaries have added two-factor authentication and in-person requirements for banking details, and banks added extra checks in 2024. The newsletter also notes other incidents, including a $320 million Bitcoin extraction from Blockstream's Liquid Network and a JetBrains Cadence breach via TeamCity servers.

Risky Business News · 9d agoPhishing & fraud in the wild1