Adobe Commerce and Magento StyleSmuggler Zero-Day Exploited for RAT Deployment
Attackers use StyleSmuggler flaw to install PSK Agent RAT and maintain remote access on Magento stores.
1
Stories per day · 30 days
5 RSS
Relatedadobe-commerce9sansec7e-commerce4polyshell4rce4webshell4brotli3ecommerce3javascript3kev3skimmer3web-skimmer3blockstrap2cisa2cve-2026-1038492javascript-loader2magecart2php2
46 stories, newest first · one card per story
Stories tagged #magento
Magento StyleSmuggler exploited to deploy PSK Agent RAT
CVE-2026-75650, scored 10.0, was hit September 9–13, 2026, before Adobe’s emergency hotfix, across stores in three regions.
2
CISA adds exploited Brotli and Adobe Commerce flaws to KEV
Federal agencies must fix CVE-2026-111497 and CVE-2026-48356 by October 29, 2026, after reported exploit traffic and store infections.
CISA adds exploited Adobe Commerce and Brotli flaws to KEV
PolyShell has hit hundreds of stores since at least July 2025; Brotli exploit traffic is also being seen.
2
Attackers infect 953 Magento stores with scanner-evading JavaScript
Sansec says the campaign, active since July 2025, has used five loader domains and the final payload is still unknown.
CISA adds Adobe Commerce and Google Brotli flaws to KEV
CVE-2026-48356 is an unrestricted upload flaw; CVE-2026-111497 is an unchecked return value bug in Brotli.
Magento stores hit by hidden CMS-block JavaScript loaders, Sansec says
Sansec saw the latest loader on 83 stores; the wider operation has hit 953 stores since July 2025.
1
Magecart-style script hits 953 Magento stores, Sansec says
The loader hides from scanners, and earlier waves used PolyShell and SessionReaper to plant webshells.
CISA adds exploited Adobe Commerce and Magento upload flaw to KEV
CVE-2026-48356 can run code as the current user; federal agencies must mitigate by November 10.
1
Magento skimmer campaign hits 953 stores across five domains
Sansec says deepveindrilling.com, registered October 6, was loaded by 83 mostly Magento stores from October 7.
1
Sansec: 953 online stores, mostly Magento, hit by scanner-evading JavaScript
Loaders in Magento CMS blocks fetch follow-on code only for real shoppers; the final payload is still unknown.
2
953 online stores infected with Magento JavaScript loaders since July 2025
Sansec says loaders on five domains fingerprint visitors and have not yielded a captured final payload.
3
deepveindrilling.com Magento loader found on 83 stores
Sixty of those stores already carried an earlier loader, and a stored payload reruns after the domain is blocked.
Critical PHP remote code execution flaw already under attack
Patchstack says the only current fix is upgrading PHP, with an update scheduled for October 21 at 14:00 UTC.
PHP to fix two critical RCEs, CVE-2026-109618 and CVE-2026-109619
The official fix is due October 21 at 14:00 UTC; PHP 8.1 and older will not get one.
Autonomous AI agents used to breach more than 1,200 websites
NorForge says exposed Cairn panels tied a Chinese-language cluster to web shells at named firms, with data theft unconfirmed.
Critical BlockStrap flaw lets hackers run code on Magento servers
Sansec warns CVE-2026-103849 can run arbitrary PHP on unpatched Magento and Adobe Commerce servers.
4
Blockstrap: Magento and Adobe Commerce RCE (CVE-2026-103849)
Sansec warns of unauthenticated Magento and Adobe Commerce RCE CVE-2026-103849, with no live exploitation seen yet.
6
U.S. CISA adds Adobe and WSO2 flaws to its Known Exploited Vulnerabilities catalog
CISA added exploited WSO2 and Adobe Commerce flaws to the KEV catalog, with federal fixes due September 27.
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
CISA added WSO2 path traversal CVE-2026-5430 and Adobe Commerce authorization flaw CVE-2026-71362 to its KEV catalog amid active exploitation.
3
AI-Powered Campaign Targets Hundreds of Online Retailers
A Chinese-speaking actor used autonomous AI agents to compromise online retailers and steal over 600,000 credit cards.
4
CISA Adds Two Known Exploited Vulnerabilities to Catalog
CISA added actively exploited WSO2 and Adobe Commerce flaws to the Known Exploited Vulnerabilities catalog.
Malicious AI agents steal 600K credit cards, infect 100+ sites with skimmers
An AI-agent campaign stole over 600,000 cards and skimmer-infected at least 119 retail sites.
2
Autonomous AI Agents Hack Online Retailers for $25 Per Target, Steal 600,000 Credit Cards
Operator using open-source AI agents Strix, Cairn, and Hermes compromised hundreds of retailers, stealing 600,000+ credit cards at about $25 per target.