Magento
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Security timeline
- Zero-day reported by Cyber Security NewsAdobe Commerce zero-day exploited to deploy PSK Agent remote access tool
- Vulnerability reported by GBHackersHackers exploit critical StyleSmuggler flaw in Magento and Adobe Commerce to deploy PSK Agent RAT
- Vulnerability reported by Qualys Threat ResearchCISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
Recent news
Cloudflare launches Zero Wire, a vulnerability briefing feed on Cloudflare Radar
Cloudflare has introduced Zero Wire, a public vulnerability intelligence feed within Cloudflare Radar's security section. It focuses on critical CVEs in Internet-facing software, such as web applications, their runtimes and libraries, and exposed services, and sorts briefings into "Needs attention" and "Reference". Each briefing includes the impact, which teams should investigate, recommended actions and links to vendor guidance, and it is useful whether or not the reader is a Cloudflare customer.
Adobe Commerce zero-day exploited to deploy PSK Agent remote access tool
A zero-day in Adobe Commerce and Magento, named StyleSmuggler and tracked as CVE-2026-75650, lets unauthenticated attackers run code on stores, affecting all current versions including 2.4.9. Imperva observed a campaign between 9 and 13 September 2026 that dropped the PSK Agent remote access tool, with a 0% detection rate on VirusTotal at the time of analysis, across Western Europe, North America and Asia-Pacific.
Hackers exploit critical StyleSmuggler flaw in Magento and Adobe Commerce to deploy PSK Agent RAT
Attackers exploited the critical StyleSmuggler vulnerability in Magento and Adobe Commerce to deploy PSK Agent, a remote access trojan that enables command execution, traffic proxying and persistent server access. The campaign ran from 9 to 13 September 2026 and targeted stores across Western Europe, North America and Asia-Pacific. Imperva's earlier analysis gives the flaw a CVSS score of 10.0 and reports exploitation before the article's cut-off.
CISA adds Brotli and Adobe Commerce PolyShell flaws to Known Exploited Vulnerabilities catalogue
CISA added CVE-2026-111497 (Google Brotli, CVSS 9.2) and CVE-2026-48356 (Adobe Commerce and Magento, CVSS 9.3) to its KEV catalogue, with federal agencies told to fix them by October 29, 2026. Sansec reported the Magento flaw, dubbed PolyShell, had been used to infect at least 953 online stores, while exploit traffic for the Brotli flaw has also been observed. Node.js, PHP, Bun and Microsoft .NET have released fixes for Brotli.