StyleSmuggler fix: patch the Magento and Adobe Commerce RCE
ID: 0cb2b82a-da85-5aed-b7c1-e2561d8f7047
STIX ID: report--0cb2b82a-da85-5aed-b7c1-e2561d8f7047
Feed Name: Aikido Security's Blog
StyleSmuggler is a critical zero-day RCE affecting all current Magento Open Source and Adobe Commerce releases, actively exploited since September 4, 2026; attackers inject PHP via GraphQL style properties that later execute during email template rendering, enabling installation of a persistent Rust-based backdoor. Aikido has released drop-in library patches and detection intelligence, Adobe had not yet published a patch or CVE at the time of the report, and temporary mitigation includes disabling GraphQL and rotating credentials if compromise is detected.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
