Dutch e-commerce security firm Sansec discovered a zero-day vulnerability in Magento Open Source and Adobe Commerce and named it StyleSmuggler. Active exploitation began on September 4, 2026. Sansec published its advisory on September 5 specifically because stores were being compromised in real time and the company did not want to wait for coordinated disclosure to complete while active attacks were underway. Adobe published emergency advisory APSB26-146 on September 7 at 20:20 UTC, assigned CVE-2026-75650, rated the flaw CVSS 10.0 with Priority 1, its highest severity classification, and released a hotfix. StyleSmuggler is a two-stage attack that does not require authentication. In the first stage, the attacker injects PHP code into a location that Magento's logging subsystem will later write to. Sansec's name reflects the injection path: the flaw specifically leverages the styles properties of Magento's template system to smuggle malicious code past the application's validation logic. A failed payment transaction email report is one of the documented injection vectors, as the payment failure handler writes attacker-controlled content to a log or queue path without adequate sanitization. In the second stage, the attacker triggers Magento to execute the poisoned code by causing the template system to process the logged content. The result is arbitrary code execution in the context of the web server without any authentication requirement and without any action from a store administrator or customer. A successful attack installs a persistent Linux backdoor on the server, typically disguised as a kernel process using a cron job, and may operate outside the Magento web root, making simple web-accessible file scans inadequate for detecting the implant. Sansec confirmed that all current Magento Open Source versions from 2.4.4 through 2.4.9 are affected and that it reproduced the full unauthenticated exploit chain on clean installations of 2.4.7, 2.4.8, and 2.4.9. The first confirmed victim was running Magento 2.4.6-p15 with Adobe's July and August 2026 security updates applied, which represents the highest patch level Adobe ships for the 2.4.6 release line. Being fully current on published patches did not prevent compromise. Adobe's emergency hotfix ships as a composer patch: download VULN-39341-composer-patches.zip from repo.magento.com and apply it. Confirm installation with the magento-patches status command. Adobe's advisory explicitly recommends that all merchants rotate their encryption key and every credential that key protects after applying the hotfix, covering admin passwords, REST, SOAP, and GraphQL integration tokens, OAuth client secrets, payment gateway API credentials, database credentials, SSH keys, deploy keys, and third-party extension API keys. Until the hotfix is applied, Sansec's recommended interim mitigation is to disable GraphQL, which removes one of the attack paths StyleSmuggler uses to reach the injection vector.

Arctic Wolf's Adversary Research Team published findings over the weekend confirming that threat actors are actively exploiting CVE-2026-81578 and CVE-2026-82078, the PaperCut authentication bypass and remote code execution chain, in sustained attacks targeting education sector organizations. Arctic Wolf observed exploitation activity across K-12 school districts and major universities in the United States and Europe. The post-exploitation activity Arctic Wolf documented goes substantially further than the web shell deployment observed in the initial August 28 incidents. The confirmed post-exploitation tools and techniques include Windows registry hive collection tools, specifically programs designed to extract copies of the Security Account Manager, SYSTEM, and SECURITY registry hives, which contain Windows credential material including password hashes for local accounts. The presence of registry hive collection tools indicates the attackers are specifically targeting credential material from the PaperCut server and any Windows systems reachable from it for use in lateral movement or offline cracking. Arctic Wolf also observed delivery of Metasploit Meterpreter-related Java payloads through the PaperCut server, establishing a persistent remote access capability through the Meterpreter framework rather than a simple web shell. Java Meterpreter payloads delivered through a Java-based application server like PaperCut can be difficult to detect with endpoint security tools that do not specifically cover Java runtime execution. The post-exploitation reconnaissance commands Arctic Wolf documented covered host identification including hostname and IP enumeration, user account enumeration, running process listing, and collection of sensitive configuration data from the PaperCut server including database connection strings and credentials stored in PaperCut's configuration files.

Google released an emergency Chrome security update on September 5, 2026, patching CVE-2026-85046, a type confusion vulnerability in the V8 JavaScript and WebAssembly engine. Security researcher Salvatore Gulizia reported the vulnerability to Google on August 4, 2026, and Google confirmed an exploit exists in the wild. Type confusion vulnerabilities in V8 occur when the engine treats a JavaScript object as the wrong type, which can be leveraged to read or write memory outside intended boundaries, enabling attackers to achieve arbitrary code execution inside Chrome's renderer sandbox through a crafted HTML page that any user who visits it would trigger automatically, with no additional interaction required. The emergency fix ships in Chrome 152.0.7977.82 and 152.0.7977.83 for Windows and macOS and 152.0.7977.82 for Linux. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog on September 5, the same day the patch was released, confirming federal civilian agencies must update Chrome immediately. CVE-2026-85046 is the sixth Chrome zero-day patched in 2026, a rate of approximately one every six weeks that represents roughly twice the pace of prior years. The prior five Chrome zero-days in 2026 spanned V8 type confusion, heap use-after-free, and sandbox escape classes. Google's emergency release was made available to Chrome's staged rollout infrastructure on September 5, which means some users will receive it automatically within hours while others in later rollout stages may not receive it for several days without manual action.