Security intelligence for enterprise commerce — analysis of the Adobe Commerce & Experience Manager landscape, and the preemptive takes the automated bulletins can’t provide.
Adobe released an emergency hotfix on September 7 for CVE-2026-75650, an unauthenticated remote code execution flaw rated 10.0 affecting every Commerce and Magento release from 2.4.4 through 2.4.9. Attacks began September 4. CISA added the flaw to its Known Exploited Vulnerabilities catalog on the …
Sansec’s public vulnerability database for Magento extensions is topped by the biggest, most established vendors — not because they’re …
Pattern AnalysisJuly 14 wasn’t one bulletin — it was a week. APSB26-73 shipped seven Adobe Commerce CVEs (two critical RCEs); the parallel AEM bulletin …
securityAPSB26-05 and APSB26-49 landed two months apart. Both lean hard on Incorrect Authorization and Stored XSS. That’s not a coincidence — it’s …
securityAdobe’s June 2026 AEM bulletin contains 27 confirmed stored XSS and 9 DOM-based XSS CVEs, all CVSS 5.4. The count is the signal — not the …
securityGitHub is rolling out its token format change again. If your CI still pins Composer or hasn’t tightened workflow permissions, you’re not …
AnalysisSansec research reveals 4,880+ fake .shop storefronts impersonating real brands with a custom checkout SDK and real-time 3DS relay. The attack …
Attack AnalysisTwo command injection vulnerabilities in Composer’s Perforce driver are exploitable even if you’ve never touched Perforce. For Magento …
Attack AnalysisThe November 2025 bulletin wave included a CVSS 9.1 session takeover, a stored XSS in Magento-lts, and an active Xurum webshell campaign. Read …
Follow via RSS or on Micro.blog.