PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

StyleSmuggler fix: patch the Magento and Adobe Commerce RCE

aikido.dev | advisory | #rce | #zero-day | #patching | #0day | #magento | #e-commerce | #adobe-commerce
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Aikido on StyleSmuggler: an unauthenticated RCE in all current Magento Open Source and Adobe Commerce versions, exploited since September 4 with no vendor patch yet, and its drop-in fixes.
Published
Collected

Related coverage

Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · netspi.com
“StyleSmuggler” – Adobe Commerce, Adobe Commerce B2B, and Magento RCE (CVE-2026-75650): Overview and Takeaways
CVE-2026-75650 (CVSS 10.0) lets unauthenticated attackers inject PHP through Magento's email template engine for RCE, with in-the-wild exploitation and Rust backdoors confirmed before the hotfix.
vulnerability · volexity.com
Detecting Compromise of CVE-2024-3400 on Palo Alto Networks GlobalProtect Devices
# Detecting Compromise of CVE-2024-3400 on Palo Alto Networks GlobalProtect Devices May 15, 2024 Volexity Threat Research Last month, Volexity reported on its discovery of zero-day, in-the-wild...
vulnerability · volexity.com
Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400)
# Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400) April 12, 2024 Volexity Threat Research > _Volexity would like to thank Palo Alto...
vulnerability · volexity.com
Zero-Day Exploitation of Atlassian Confluence
UPDATE: On June 3, 2022, Atlassian updated its security advisory with new information regarding a fix for Confluence Server and Data Center to address CVE-2022-26134. Users are encouraged to update immediately to […]
vulnerability · volexity.com
Operation EmailThief: Active Exploitation of Zero-day XSS Vulnerability in Zimbra
[UPDATE] On February 4, 2022, Zimbra provided an update regarding this zero-day exploit vulnerability and reported that a hotfix for 8.8.15 P30 would be available on February 5, 2022. This vulnerability […]
Back