Critical Magento Zero-Day CVE-2026-75650 Exploited Before Patch, Rust Backdoor Deployed

·2 views

Adobe released an emergency out-of-band patch on September 8, 2026 for CVE-2026-75650, a maximum-severity CVSS 10.0 unauthenticated remote code execution vulnerability affecting Adobe Commerce and Magento Open Source versions 2.4.4 through 2.4.9. Security firm Sansec, which named the flaw StyleSmuggler, confirmed attackers began exploiting it four days earlier on September 4, giving them a head start on unpatched merchants. The vulnerability resides in Magento's template system and allows a single unauthenticated HTTP request to execute arbitrary code by injecting PHP through the email template path used for payment failure reminders. Observed payloads include a Rust-based Linux backdoor that communicates with an external server and a PHP web shell capable of writing arbitrary code to checkout hosts. Adobe's advisory requires merchants to apply the VULN-39341 hotfix from repo.magento.com and mandatorily rotate encryption keys, as the keys protect stored payment configurations, API credentials, and integration tokens that may have been exposed during the zero-day window.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Relay Tool Aims to Preserve Full Dev Loop Beyond Simple Port Sharing

A developer building a tool called Relay argues that simply exposing a local port to remote users solves only a superficial part of collaborative development. Relay is designed to sit between a local development server and connected clients while keeping the full development loop intact, including WebSockets, asset loading, and hot module replacement. The tool supports HMR and Fast Refresh across frameworks like Vite, React, Next.js, and Turbopack without requiring changes to the developer's workflow. Beyond live updates, Relay also sends diagnostics back from connected clients, including console output, JavaScript exceptions, and failed network requests. This two-way feedback loop aims to eliminate the guesswork that typically arises when remote testers encounter issues during shared development sessions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Laravel 13 Arrives with Native AI Tools, Semantic Search, and Performance Gains

Laravel 13, the latest version of the widely used PHP web framework, has been released with a focus on developer productivity and modern application needs. The update introduces first-party AI capabilities, enabling developers to work natively with text generation, embeddings, images, audio, and vector stores. Laravel 13 also expands semantic and vector-based search support, allowing applications to retrieve results based on meaning rather than exact keyword matches. Additional improvements span queues, caching, filesystem handling, developer tooling, and overall application performance. The release requires PHP 8.3 or higher and is aimed at developers building SaaS products, APIs, AI-powered apps, and content platforms.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer explains why AI-generated code no longer feels like a threat

A software developer writing for DEV Community reflects on how AI coding tools transformed his workflow between late 2024 and mid-2025, describing three distinct capability jumps during that period. He notes that by November 2025, AI models began producing code close enough to correct that editing it became cheaper than writing from scratch. A further leap early this year expanded the scope of projects he could realistically tackle, including work he had considered impossible for over a decade. By summer, the combination of improved models, a robust CI/CD pipeline, and a well-structured codebase meant the AI was producing code he considers better than what he would have written himself. He argues that reduced code-reading is not negligence but a rational shift in trust — one only valid, he stresses, when backed by thorough automated testing and verification.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How one team synced template updates across 68 repos using git cherry-pick

A development team managing roughly 100 repositories discovered that 68 of them, all created from the same GitHub template, had diverged significantly in version — ranging from 1.0.0 to 4.35.4. GitHub template repositories create a full copy with no shared commit history, making standard git merge and rebase operations fail due to unrelated histories. The team found that git cherry-pick, which applies patches without requiring a common ancestor, was the only native git tool capable of propagating upstream template changes into child repositories. To handle edge cases, they built rules distinguishing files fully owned by the repo, files partially shared with the template, and files entirely owned by the template, ensuring local customisations were preserved during updates. They also added safeguards such as rolling back failed runs entirely, skipping merge commits with --no-merges, and explicitly listing every file the template overwrote so engineers could review unintended changes.

0 comments Read more at DEV Community