AI-Accelerated Attacks and Zero-Days Push Defenders Toward Machine Speed

Published September 11, 2026

Adobe Commerce's online store software has a critical flaw that lets attackers install hidden malware on your servers. This can steal passwords, payment info, and other sensitive data.

Severity
Not scoredNo CVSS score recorded
Affects
Adobe Commerce

How it works

  • Attackers send a specially crafted request to Adobe Commerce's web server.
  • The server fails to properly check the request, letting the attacker run code on your server outside the normal web files.
  • This lets the attacker install malware that keeps running even after the attack stops.
  • The malware can then steal passwords, tokens, and payment details from your system.

What to do

If you run Adobe Commerce versions 2.4.0 through 2.4.7-p1, 2.3.0 through 2.3.7-p3, or 2.2.0 through 2.2.11-p3, check your installed version by running php bin/magento --version in your Adobe Commerce directory. If your version matches any of the affected ranges, proceed to the next step.

Apply Adobe's hotfix immediately by following the instructions in Adobe's official advisory. Check your server for any suspicious files or processes outside the normal Adobe Commerce directories. Rotate all credentials, tokens, and payment secrets that may have been exposed. Monitor your system for unusual activity.

Technical details

A remote-code-execution vulnerability in Adobe Commerce (CVE-2026-75650) is being actively exploited to install persistent malware outside the web root, exposing credentials, tokens, and payment data. Attackers can bypass standard web directories to maintain access, requiring immediate application of Adobe's hotfix and credential rotation. Microsoft's September 2026 Patch Tuesday addressed nearly 1,000 flaws, including two Windows zero-days (CVE IDs undisclosed) already under attack.

Organizations must prioritize patching these critical issues, especially in exposed or high-value systems, while evaluating existing security controls. Google patched two Chrome zero-days (CVE-2026-85046 and an unnamed seventh in 2026) allowing arbitrary code execution via crafted webpages. Both vulnerabilities exploit Chrome's V8 engine or sandbox, enabling attackers to run malicious code within the browser.

Administrators must ensure managed browsers are updated and monitor for suspicious activity.

View Original Source