In this week’s TL’DR, We cover the targeting of two major internet-facing platforms. Adobe Commerce operators must deploy an emergency hotfix, while SonicWall customers must patch their systems and check whether attackers compromised their remote-access infrastructure before they installed the update.
Adobe Commerce and Magento Stores Backdoored Through Critical Zero-Day
The Hacker News reported that attackers were exploiting a previously unknown flaw in Magento Open Source and Adobe Commerce. The vulnerability allows an unauthenticated attacker to execute code on a store’s server and install a persistent backdoor.
Security researchers named the attack StyleSmuggler. It abuses Magento’s email-template processing, meaning the malicious code can run while the platform generates a failed-payment notification. Nobody needs to open the email. Researchers reproduced the attack against several current Magento versions, including systems with the latest security updates available at the time.
The implant installs outside the normal web root and maintains persistence through scheduled tasks. This matters because security scans limited to website directories may report a clean result even when the server remains compromised. The implant was also observed accessing Magento session data.
Adobe has since released an emergency security update for CVE-2026-75650. The company rates the flaw critical, with a CVSS score of 10, and confirms that it is being exploited in the wild.
Adobe Commerce and Magento – TL;DR
Apply Adobe’s CVE-2026-75650 hotfix immediately. Then check the full hosting account for compromise, invalidate active sessions, and rotate administrative, payment, encryption, and integration credentials where suspicious activity is found. Installing the hotfix does not remove an existing backdoor.
SonicWall SMA 1000 Zero-Days Allow Remote Code Execution
Dark Reading reported that attackers were actively exploiting two vulnerabilities in SonicWall SMA 1000 remote-access appliances.
CVE-2026-83548 is a pre-authentication server-side request forgery flaw with a maximum CVSS score of 10. CVE-2026-83549 is a command-injection vulnerability that requires authentication on its own. However, researchers found that the two flaws can be chained, allowing an unauthenticated attacker to execute commands remotely on a vulnerable appliance.
The affected systems include SMA 1000 models 6210, 7210, and 8200v running platform hotfix versions 12.4.3-03453, 12.5.0-02835, or earlier. SonicWall confirmed that exploitation was ongoing and released fixed firmware.
These appliances sit at the edge of corporate networks and provide remote access to internal resources. As a result, compromising one can give an attacker a trusted position from which to target credentials, sessions, and connected systems. Patching closes the vulnerabilities, but organisations must still investigate whether attackers previously compromised the appliance.
SonicWall SMA 1000 – TL;DR
Upgrade immediately to platform hotfix 12.4.3-03526, 12.5.0-02952, or later. Investigate for earlier access after patching. If compromise is detected, SonicWall recommends rebuilding or redeploying the appliance, changing user and administrator passwords, and resetting TOTP tokens.
Conclusion
Both stories involve security products or platforms exposed directly to the internet, where attackers can move faster than a normal maintenance cycle. Prioritise emergency fixes for edge systems, but pair patching with compromise assessment and credential rotation. A patched system can still contain an attacker who arrived yesterday.
ThinScale helps organisations strengthen endpoint controls and secure access across remote, hybrid, and distributed environments. Contact ThinScale to discuss how these controls can support your security.
