#magento
-
CISA adds Adobe Commerce and Brotli flaws to KEV as PolyShell hits hundreds of stores
CISA has confirmed active exploitation of two critical vulnerabilities, one in Adobe Commerce and Magento and one in Google's Brotli decoder library. The first has already been used to breach hundreds of online stores, and the second has prompted emergency updates from dozens of vendors.
-
953 Online Stores Hit by JavaScript That Hides From Scanners
Since July 2025 an unknown group has planted a malicious loader in Magento stores — code that tells real shoppers apart from security scanners and only serves its payload to live visitors.
-
Critical BlockStrap flaw threatens Magento servers
Researchers warn that the maximum-severity vulnerability CVE-2026-103849 in Magento and Adobe Commerce could let attackers run arbitrary PHP code on store servers.
-
CISA Adds Exploited WSO2 and Adobe Commerce Flaws to Its KEV Catalog
The U.S. cybersecurity agency CISA has added two critical flaws in WSO2 and in Adobe Commerce and Magento to its KEV catalog, citing evidence of active attacks. Federal agencies must patch them by September 27, 2026.
-
StyleSmuggler: An Unpatched Magento 0-Day Is Already Being Used to Break Into Stores
The Dutch firm Sansec has disclosed a critical vulnerability in Magento Open Source and Adobe Commerce that allows code execution on the server without authentication. Attacks are happening right now, and there's still no patch from Adobe.
-
Hackers Target Critical Adobe Commerce Flaw to Hijack Shopper Accounts
Attempts have been detected to exploit CVE-2026-71362 in the Adobe Commerce and Magento platforms, a flaw that allows unauthenticated takeover of other users' sessions.