Critical Zero-Day CVE-2026-75650 in Adobe Commerce and Magento Allows Unauthenticated Remote Code Execution, Already Exploited
Adobe has issued an urgent security update for Adobe Commerce and Magento after identifying a severe zero-day vulnerability that allows unauthenticated remote code execution. The flaw, designated CVE-2026-75650, has already been exploited in active attacks, prompting the company to release a hotfix and assign the highest remediation priority.
The vulnerability arises because the template engine fails to properly neutralize special elements, enabling attackers to inject and execute arbitrary code remotely without requiring any credentials. Adobe published its security advisory on September 7, 2026, classifying the issue as Critical — the highest of its three-tier severity scale.
Under the CVSSv3.1 scoring system, the vulnerability received the maximum base score of 10.0, confirming its extreme risk level. Adobe states that real-world exploitation has been observed, which significantly raises the urgency for organizations running affected versions.
To address the issue, Adobe has prepared a dedicated hotfix that resolves CVE-2026-75650. The company rates the update priority as 1 on its three-tier scale and recommends applying the patch within 72 hours whenever possible.
Customers are strongly advised to review the official Adobe security advisory and deploy the fix immediately to prevent potential compromise of their e-commerce platforms.
Related articles
PHP Patched Against PHP2Shell: Save php -v Output as Potential Court Evidence
Two critical remote code execution vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619 were disclosed on October 21, 2026, affecting the PHP core interpreter across all versions below 8.2.35, 8.3.36, 8.4.27, and 8.5.12. The flaws, collectively called PHP2Shell, carry a CVSS 4.0 score of 9.2 and allow unauthenticated attackers to execute arbitrary code on servers running WordPress, 1C-Bitrix, Drupal, OpenCart, Laravel, and other frameworks. Official patches have been released, yet organizations must also restart PHP-FPM, web servers, and queue workers to fully eliminate the vulnerable code from memory. Russian regulators may impose fines up to 15 million rubles for personal data leaks stemming from unpatched instances, and courts will examine documentation proving when and how the vulnerabilities were addressed. Security teams are advised to preserve command outputs from php -v and php-fpm -v along with timestamps and responsible-party records. If signs of compromise are detected, logs must be retained before any remediation steps are taken, and notifications to Roskomnadzor must be filed within 24 hours of confirmed data exposure.
Black October Hype: Media Inflates AI Agent Role in PHP, GitLab and Cloud Platform Incidents
A detailed analysis reveals that recent high-profile cybersecurity stories have been sensationalized by attributing autonomous AI agent swarms to standard vulnerability disclosures and human-operated attacks. Critical PHP zero-day flaws enabling remote code execution were responsibly researched with GPT-5.6 Sol under OpenAI's Patch the Planet program, not by rogue AI bots launching millions of scans. The Argentina hospital compromises involved human operators using Anthropic's Claude Code CLI tool in a Human-in-the-Loop workflow rather than uncontrolled AI rebellion. Breaches at Zeabur, Railway and OpenCode stemmed from poor secret management and forgotten consoles, allowing credential theft for API abuse. A decade-old integer overflow in GitLab's Onigmo regex engine received a CVSS 10.0 score but had no connection to AI. The piece argues that adding AI narratives boosts clicks while obscuring classic attack patterns such as masscan-driven scanning after public PoC leaks.
Apple Patches 163 Vulnerabilities in iOS 27.2 Including Multiple WebKit Code Execution Flaws
Apple released iOS 27.2 and iPadOS 27.2 on October 26, addressing 163 vulnerabilities across its mobile platforms. More than 30 of these issues reside in the WebKit engine, with several enabling remote code execution simply by visiting a malicious webpage. The update also resolves two sandbox escapes, one in WebKit's process model and another in the App Store reported by Cisco Talos researchers. Four privacy-related fixes include a flaw in Apple Intelligence that could expose sensitive user data to remote attackers. On the same day, Apple issued iOS 18.7.11 for older devices such as the iPhone XS and XR, fixing a CoreGraphics out-of-bounds write tracked as CVE-2026-86950 that had already been exploited in a highly sophisticated targeted attack. The company stated that none of the 163 flaws in the main release have been observed in the wild.
Fuzzilli vs BigSleep: 37 and 45 Vulnerabilities Found in V8 Over Six Months with 25% Overlap
Google's Project Zero compared two automated vulnerability discovery tools targeting the V8 JavaScript engine in Chrome. The generative fuzzer Fuzzilli identified 37 actionable vulnerabilities over six months, while the LLM-based agent BigSleep found 45. Only about 25% of the vulnerabilities overlapped between the two systems. Additional experiments on historical bugs from 2023 onward showed a theoretical overlap of around 60%. The analysis indicates that fuzzing and LLM agents complement each other rather than one replacing the other. Researchers recommend using both approaches together to maximize coverage of complex bugs in well-tested software like V8.