#Magento
All CosmicBytez Labs articles tagged #Magento, across news, security advisories, how-to guides, and projects.
- News
WSO2 and Adobe Commerce Flaws Exploited in Attacks, Added to CISA KEV
CISA added WSO2's CVE-2026-5430 (CVSS 9.8) and Adobe Commerce/Magento's CVE-2026-71362 (CVSS 9.1) to its KEV catalog after confirmed in-the-wild exploitation.
- Security
CVE-2026-71362: Adobe Commerce and Magento Incorrect Authorization Vulnerability
CVE-2026-71362 (CVSS 9.1) lets unauthenticated attackers hijack Adobe Commerce and Magento customer sessions; CISA added it to KEV after active exploitation.
- News
Adobe Rushes Emergency Fix as Magento "StyleSmuggler" Zero-Day Backdoors Servers
A max-severity Magento/Adobe Commerce zero-day, StyleSmuggler, has been exploited since September 4 to plant Linux backdoors on live stores.
- Security
CVE-2026-75650: StyleSmuggler Zero-Day Grants Unauthenticated RCE in Adobe Commerce & Magento
A maximum-severity template injection flaw in Adobe Commerce and Magento is under active exploitation, letting attackers plant Linux backdoors pre-auth.
- Newsletter
Weekly Digest — Issue #34
Adobe rushes an emergency patch as Magento's 'StyleSmuggler' zero-day backdoors stores, an F5 BIG-IP rootkit hides fileless, and JetBrains leaks AWS keys.
- News
Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
StyleSmuggler, a Magento zero-day found by Sansec, injects PHP via failed-payment emails to drop a Rust backdoor on live stores.
- News
'StyleSmuggler' Zero-Day in Magento and Adobe Commerce Is Actively Backdooring Live Stores
Sansec found an unpatched Magento/Adobe Commerce 0-day, StyleSmuggler, giving unauthenticated RCE via poisoned templates rendered in failed-payment emails.
- News
Hackers Exploit Critical Adobe Commerce Flaw to Hijack Customer Accounts
Active exploitation of CVE-2026-71362 in Adobe Commerce and Magento is underway, with attackers targeting customer account takeover on e-commerce storefronts.
- News
CISA Adds Exploited Magento RCE Flaw CVE-2026-45247 to KEV Catalog
CISA has added a critical remote code execution vulnerability in the Mirasvit Cache Warmer Magento extension to its Known Exploited Vulnerabilities catalog…
- Security
CVE-2026-45247 — Mirasvit Magento 2 Cache Warmer PHP Object Injection RCE
CVSS 9.8 PHP object injection in Mirasvit Full Page Cache Warmer for Magento 2 lets unauthenticated attackers achieve RCE — patch to 1.11.12 now.
- News
Hackers Use Pixel-Large SVG Trick to Hide Credit Card
A massive campaign targeting nearly 100 Magento e-commerce stores embeds credit card-stealing JavaScript inside a pixel-sized SVG image, bypassing visual...
- News
PolyShell Attacks Target 56% of All Vulnerable Magento
Mass exploitation is underway against Magento 2 and Adobe Commerce installations using the 'PolyShell' polyglot file upload vulnerability, with attackers...
- News
WebRTC Skimmer Bypasses CSP to Steal Payment Data from E-Commerce Sites
Cybersecurity researchers have uncovered a sophisticated new payment skimmer that weaponises WebRTC data channels to exfiltrate stolen credit card data...
- Newsletter
Mar 26 Digest: LeakBase Admin Arrested, WebRTC Skimmer
This week: Russian authorities detain the alleged LeakBase admin weeks after the FBI-led global crackdown on the 147,000-subscriber stolen-data...