Critical Zero-Day Exploit in Magento & Adobe Commerce Under Active Attack A severe zero-day vulnerability, dubbed StyleSmuggler, is being actively exploited to gain full control of online stores running Magento Open Source and Adobe Commerce. Disclosed by Dutch security firm Sansec on September 5, 2026, the flaw allows unauthenticated attackers to execute remote code (RCE) on vulnerable systems, with attacks confirmed as early as September 4. The vulnerability affects all current versions of Magento and Adobe Commerce, including the latest 2.4.9 release, and requires no authentication to exploit. Even fully patched stores such as one running 2.4.6-p15 with all July and August 2026 security updates have been compromised, demonstrating the flaw’s severity. ### Exploit Mechanics & Attack Chain The attack unfolds in two stages, leveraging Magento’s template rendering and email systems: 1. Initial Exploitation – Attackers manipulate "styles" properties in a GraphQL request to inject malicious PHP code into a file Magento generates during normal operations (e.g., payment failure reports). 2. Trigger Execution – The exploit forces Magento to send a "Payment Transaction Failed Reminder" email, executing the poisoned code without requiring the email to be opened or received. Once triggered, the malware deploys a Rust-based implant (1.9MB, compiled for x86-64 and ARM64) disguised as a Linux kernel thread ([kworker/u:8:0]) to evade detection. The implant persists via a cron job, restarts every five minutes, and avoids standard logging by writing directly to the crontab spool file. ### Evasion & Detection Challenges - The malware mimics legitimate kernel processes, making detection difficult. - It modifies its in-memory binary, requiring defenders to hash both the file and live process. - Some variants avoid external connections, instead querying the site’s Redis instance to steal session data, bypassing network monitoring. - Sansec’s detection guidance suggests checking `var/report`, but compromised stores have also been found with infections in `var/log/system.log`. ### Mitigation & Response With no official patch from Adobe as of September 6, store owners are relying on temporary measures: - Disabling GraphQL for stores not using headless or PWA frontends. - Unofficial patches from Disrex, ProxiBlue, and Graycore, which harden specific Magento classes but do not fully resolve the vulnerability. - Server-level protections, such as disabling `proc_open` and mounting temporary directories with `noexec`, to block payload execution. Adobe’s next scheduled security release is September 8, but there is no confirmation that it will address this flaw. The company has yet to issue an advisory, assign a CVE, or provide an official workaround.

Dropbox Security Breach Exposes Flaw in Third-Party SSO Authentication Dropbox recently notified multiple users of unauthorized access to their accounts between August 4 and August 21, 2026, stemming from a vulnerability in its single sign-on (SSO) integration with Lenovo IDs. While the company confirmed no files were viewed or downloaded, the incident highlights critical gaps in authentication protocols. The breach occurred when attackers exploited Lenovo’s flawed email verification process to register Lenovo IDs using victims’ email addresses without requiring inbox access. These rogue IDs were then used to log into Dropbox accounts via Lenovo’s SSO, as Dropbox did not require re-authentication for new identity providers. The attack relied on publicly available email addresses (e.g., from breaches or LinkedIn) and bulk registration tactics, with some fake accounts using disposable names like "John Madden." Security analysts note that while Lenovo’s verification failure enabled the attack, Dropbox’s lack of secondary authentication for new SSO logins was the primary vulnerability. The company has since patched the flaw and invalidated all sessions linked to Lenovo IDs. The incident underscores risks in federated identity systems when trust in third-party providers is not properly validated.

DigiCert Revokes Fraudulently Obtained Certificates Following Cyberattack On April 2, digital certificate authority DigiCert fell victim to a cyberattack after a threat actor targeted its support team with malware disguised as a screenshot in a customer chat channel. The malicious payload infected two endpoints one detected on April 3 and another on April 14, with the delayed discovery of the second infection attributed to malfunctioning security tools. The attackers exploited a limited-access function in DigiCert’s internal support portal, leveraging the ability of authenticated support analysts to proxy into customer accounts. This allowed them to obtain initialization codes for pending Extended Validation (EV) Code Signing certificate orders. With these codes and approved orders, the threat actor successfully issued fraudulent certificates across multiple customer accounts and certificate authorities (CAs). By April 17, DigiCert identified and revoked 60 certificates tied to the incident, including 27 directly linked to the attacker. Of these, 11 were reported by the cybersecurity community and had been used to sign the Zhong Stealer malware. The company confirmed that no other internal systems were compromised beyond the unauthorized access to initialization codes. In response, DigiCert revoked all potentially affected certificates, canceled pending orders to block further exploitation, and implemented stricter security measures. These include enforcing multi-factor authentication (MFA) for administrative workflows, restricting support users from accessing initialization codes, limiting file types in support chats and Salesforce case attachments, and enhancing logging capabilities.

Critical vulnerabilities were discovered in Lenovo’s AI-powered customer support chatbot, Lena, which leverages OpenAI’s GPT-4. The flaw stemmed from improper input and output sanitization, exposing the system to cross-site scripting (XSS) attacks. Security researchers at Cybernews demonstrated that attackers could exploit this by injecting malicious code via a 400-character prompt, tricking the AI into generating harmful HTML content. This enabled threat actors to steal session cookies, potentially granting unauthorized access to Lenovo’s customer support systems.The vulnerability highlighted significant risks in poorly secured AI implementations, particularly as enterprises accelerate AI adoption. While no evidence of active exploitation was reported, the flaw posed a serious threat to customer data integrity and system security. Had attackers successfully leveraged this, they could have compromised user sessions, accessed sensitive support-related information, or escalated privileges within Lenovo’s infrastructure. The incident underscores the urgency for robust AI security frameworks to prevent such exposures in high-stakes enterprise environments.

Lenovo devices running on vulnerable Insyde firmware were targeted by the BootKitty Linux UEFI bootkit exploiting the LogoFAIL flaws (CVE-2023-40238). BootKitty bypassed UEFI Secure Boot by injecting rogue certificates and exploiting vulnerabilities in UEFI image-parsing components through tampered BMP files. The bootkit was capable of disabling kernel signature verification, preloading malicious binaries, and targeting specific Ubuntu versions. Despite available security patches, many devices remained at risk. The incident served as a reminder of the dangers associated with unaddressed vulnerabilities and the importance of timely updates to safeguard devices in the field.

A significant security vulnerability has been discovered in Lenovo’s preloaded Windows operating systems, where a writable file in the Windows directory enables attackers to bypass Microsoft’s AppLocker security framework. The issue affects all variants of Lenovo machines running default Windows installations and poses serious implications for enterprise security environments. Key takeaways include the writable MFGSTAT.zip file bypassing AppLocker security due to incorrect permissions, the use of Alternate Data Streams to hide executables, and the persistence of the vulnerability from 2019 to 2025. Mitigation strategies involve removing the vulnerable file using PowerShell or other enterprise management tools.