erroneo.us
Search all guides⌘K

Digest · Monday

Security digest: September 7, 2026

1 editorial brief and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Act now: StyleSmuggler. Every merchant, agency and host running Adobe Commerce 2.4.4-2.4.9, Commerce B2B 1.3.3-1.5.3 or Magento Open Source 2.4.6-2.4.9, including Adobe Commerce on cloud infrastructure, plus anyone still on unsupported 2.4.3 or older.
  • npm: 1 critical advisory (@sap/cds-mtxs). Check with npm audit (or: npm ls <package>).
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Act now

· Vulnerability · CVE-2026-75650, CVE-2026-103849

Magento StyleSmuggler CVE-2026-75650: Exploited Pre-Auth RCE

Any self-run Magento or Adobe Commerce store without the September hotfix should be presumed compromised: patch, then scan, then rotate the encryption key and every credential it protects, and add the October fix for the follow-on BlockStrap bug.

Must act: Every merchant, agency and host running Adobe Commerce 2.4.4-2.4.9, Commerce B2B 1.3.3-1.5.3 or Magento Open Source 2.4.6-2.4.9, including Adobe Commerce on cloud infrastructure, plus anyone still on unsupported 2.4.3 or older.

Can relax: Stores on hosted SaaS platforms such as Shopify or BigCommerce, and teams with no Magento code anywhere in production.

  1. Check whether the hotfix is present: vendor/bin/magento-patches -n status | grep "39341\|Status"
  2. Apply the VULN-39341 hotfix for your patch level, then the October 2026 release or isolated patch for CVE-2026-103849; keep both.
  3. Scan the store for StyleSmuggler implants, web shells and skimmers before declaring it clean; the hotfix does not remove them.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

npm 1

Check: npm audit (or: npm ls <package>)