ADOBE COMMERCE MAX-SEVERITY BUG COMES UNDER ACTIVE ATTACK

Summary from the TLDR InfoSec newsletter

Threat actors are actively exploiting CVE-2026-75650, a max-severity unauthenticated code execution vulnerability dubbed StyleSmuggler, to compromise online stores running Adobe Commerce and Magento Open Source. Exploitation began on September 4, with the deployment of a Rust backdoor and a separate PHP web shell. Adobe released emergency hotfix VULN-393411 to address the flaw, prompting Sansec to warn that patching alone is insufficient for stores that may already be compromised.