An Attacker Leaves His Own Door Open An attacker hacked thousands of shops. Then he left the door to his own infrastructure open. A check of an exposed server run by the Lockster operator showed the scale of the damage. Through a critical zero-day in Magento Open Source and Adobe Commerce, attackers compromised at least 3,834 sites. Most were online stores.

Adobe shipped an emergency hotfix for a maximum-severity flaw in Adobe Commerce and Magento on September 7, 2026. The Adobe Commerce vulnerability, CVE-2026-75650, scores a perfect 10.0 CVSS. It gives unauthenticated attackers arbitrary code execution. Adobe confirms the flaw is exploited in the wild. Why this matters Magento and Adobe Commerce power a huge share of online retail. So a server takeover exposes customer data and payment flows.

Adobe released its September 2026 security update for Magento and Adobe Commerce, but merchants must separately install the CVE-2026-75650 StyleSmuggler emergency hotfix.