[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSeznoQrHwjCnjBsSuxiWdWmrvlzOrMpbbEbNiTxyZlI":3},{"article":4,"iocs":54,"watch_terms":62,"solutions":63,"lesson":124},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"b366e1ce-8ff7-4fec-b2e2-eb94d93ba9ff","Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores","unpatched-magento-and-adobe-commerce-zero-day-exploited-to-backdoor-online-store-9eeec1","Attackers are exploiting a new unpatched vulnerability in Magento Open Source and Adobe Commerce that lets them run malicious code on an online store's server without logging in, Dutch e-commerce security company Sansec said in an advisory published on September 5. Sansec, which discovered the flaw and named it StyleSmuggler, said attacks started on September 4. \"Sansec is publishing early","A new unpatched zero-day vulnerability, dubbed StyleSmuggler, is being actively exploited in Magento Open Source and Adobe Commerce. The flaw allows attackers to gain unauthenticated code execution and install persistent backdoors on online store servers. All current versions are reportedly affected, and attacks began shortly before the vulnerability was publicly disclosed.","Unpatched Magento and Adobe Commerce zero-day exploited to backdoor online stores.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Funpatched-magento-and-adobe-commerce.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjghsT_skiIfdOHK2B0WWDfWnSK0G5Ih7BqsX98tKrY4TH7I77oLEmnldtVHuUMEQaIiZZBSPJGI2t8Me7h9kDtE4YGZ9-5NypnAu2-yFFrXsWYkR6OJPlbqkZDEHBAXCmRjWm6Mk4h0Ni48JT0nrDWMYygztjoi4HuHPbe2y-2jreFVkzrxO8r4IhHIEU\u002Fs1600\u002Fadobe-exploit.jpg","2026-09-05T20:14:47+00:00","2026-09-05T22:00:22.312545+00:00",9,[17,20,22,25,27,29],{"name":18,"type":19},"Magento Open Source","product",{"name":21,"type":19},"Adobe Commerce",{"name":23,"type":24},"Sansec","vendor",{"name":26,"type":24},"Adobe",{"name":28,"type":19},"GraphQL",{"name":30,"type":19},"Hyvä","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,58],{"type":48,"value":56,"context":57},"StyleSmuggler","Name of the zero-day vulnerability and associated implant.",{"type":59,"value":60,"context":61},"mitre_attack","T1070.004","Disguised implant under [kworker\u002Fu:8:0], a Linux kernel process name.",[26,23,18],{"controls":64,"vendors":123},[65,94],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":95,"name":96,"problem":97,"products":98},"patch-management","Automated patch management","Known holes get closed in days, not months.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[],{"slug":125,"title":126,"body":127,"framework_refs":128,"framework_notes":140},"zero-day-backdoor-exploited-in-magento-and-adobe-commerce-stores","Zero-Day Backdoor Exploited in Magento and Adobe Commerce Stores","The StyleSmuggler zero-day vulnerability exposed a critical gap in patch management and vulnerability response for e-commerce platforms running Magento Open Source and Adobe Commerce. Because no patch was available at the time of active exploitation, attackers were able to gain unauthenticated remote code execution and install persistent backdoors before defenders could respond. This highlights the danger of zero-day exposure windows for internet-facing commerce systems that handle sensitive customer and payment data. The fact that attacks began before public disclosure suggests threat actors had prior knowledge, underscoring the need for proactive monitoring and defense-in-depth strategies rather than relying solely on patch availability.",[129,130,131,132,133,134,135,136,137,138,139],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-61: Computer Security Incident Handling Guide","NIST SI-7: Software, Firmware, and Information Integrity","NIST RA-5: Vulnerability Monitoring and Scanning","NIST SC-7: Boundary Protection (Network Segmentation)","PCI DSS Requirement 6.3: Security Vulnerabilities are Identified and Addressed","PCI DSS Requirement 11.3: External and Internal Vulnerabilities are Regularly Tested","GDPR Article 32: Security of Processing (technical measures to ensure integrity)","OWASP Top 10: A06 Vulnerable and Outdated Components",{}]