[magento]

October 25, 2026

• Adobe Commerce / Magento account-takeover exploit (CVE-2026-71362) is public. The incorrect-authorization flaw lets an attacker manipulate customer session identity state and take over another customer's account without the password, with no authentication or user interaction. CVSS 9.1; affects through the July 2026 isolated-patch level, fixed in August 2026. (PoC) · New Tools & Releases

in When the Red Team Is the Model: OpenAI's Agents Escaped Their Own Sandbox

September 8, 2026

• StyleSmuggler now has a payload profile. Sansec reports the first exploitation on 4 September against a target running the latest security updates; the exploit abuses Magento's template system via PHP code injection to generate a fake "failed-payment" email that triggers execution, installing a small Rust backdoor disguised as [kworker/u:8:0], or in newer samples as fc-cache under ~/.cache/fontconfig/, with a cron job every 30 minutes for persistence. Earlier samples beaconed over TLS/WebSockets; newer ones disguise C2 as NTP, sending UDP to port 123 with time-server-styled hostnames, and check TracerPid — if tracing is active the malware installs but stays silent. Sansec flags an unexpected surge of "Payment Transaction Failed Reminder" emails as an indicator and recommends disabling GraphQL until Adobe ships a fix (BleepingComputer, SecurityWeek). @Dinosn claims exploitation attempts have been "massive" and says he will publish a PoC and lab after a patch lands — treat the scale claim as unverified (earlier coverage). · Vulnerabilities & Exploits

in N-able Ships a Fourth N-central Hotfix in Five Weeks — and Can't Agree Whether It's Exploited