[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"blog-post-adobe-patched-stylesmuggler-step-1-of-14":3},{"name":4,"created_at":5,"published_at":6,"updated_at":7,"id":8,"uuid":9,"content":10,"slug":187,"full_slug":188,"sort_by_date":189,"position":190,"tag_list":191,"is_startpage":192,"parent_id":193,"meta_data":189,"group_id":194,"first_published_at":6,"release_id":189,"lang":195,"path":189,"alternates":196,"default_full_slug":189,"translated_slugs":189},"Adobe patched StyleSmuggler. That is step 1 of 14.","2026-09-08T06:30:30.326Z","2026-09-08T06:30:30.374Z","2026-09-08T06:30:30.386Z",217741026640609,"1de7ede1-ae59-40be-8cbf-d6099b35703c",{"_uid":11,"body":12,"title":4,"excerpt":184,"component":185,"publish_at":186},"dd305e2e-983c-4149-8716-fbd8d5516a91",{"type":13,"content":14},"doc",[15,32,36,43,60,64,69,73,125,129,134,138,149,153,158,162,167,171,176,180],{"type":16,"content":17},"paragraph",[18,21,30],{"text":19,"type":20},"Adobe shipped the StyleSmuggler fix on 7 September as ","text",{"text":22,"type":20,"marks":23},"APSB26-146",[24],{"type":25,"attrs":26},"link",{"href":27,"target":28,"linktype":29},"https:\u002F\u002Fhelpx.adobe.com\u002Fsecurity\u002Fproducts\u002Fmagento\u002Fapsb26-146.html","_blank","url",{"text":31,"type":20},". It is CVE-2026-75650, CVSS 10.0, and Adobe confirms it was exploited in the wild before the fix existed.",{"type":16,"content":33},[34],{"text":35,"type":20},"Apply it today. Then read the rest of this, because the patch is step 1 of 14.",{"type":37,"attrs":38,"content":40},"heading",{"level":39},2,[41],{"text":42,"type":20},"It is a hotfix, not a release",{"type":16,"content":44},[45,47,52,54,58],{"text":46,"type":20},"There is no new 2.4.x version to upgrade to. Adobe ships this as a composer patch, ",{"text":48,"type":20,"marks":49},"VULN-39341-composer-patches.zip",[50],{"type":51},"code",{"text":53,"type":20},", from ",{"text":55,"type":20,"marks":56},"repo.magento.com",[57],{"type":51},{"text":59,"type":20},". Everything from 2.4.4 to 2.4.9 is affected, Open Source and Commerce, plus B2B 1.3.3 through 1.5.3.",{"type":16,"content":61},[62],{"text":63,"type":20},"If you put a community patch in place last week, this replaces it. Take yours back out once Adobe’s is live, or you will be carrying two guards that do the same job and one of them will surprise you at the next upgrade.",{"type":37,"attrs":65,"content":66},{"level":39},[67],{"text":68,"type":20},"The eight rotations nobody is going to do",{"type":16,"content":70},[71],{"text":72,"type":20},"Adobe’s own remediation list is fourteen steps. Four of them are maintenance mode and cron. One is the patch. The other eight are credential rotations:",{"type":74,"content":75},"bullet_list",[76,83,89,95,101,107,113,119],{"type":77,"content":78},"list_item",[79],{"type":16,"content":80},[81],{"text":82,"type":20},"the encryption key",{"type":77,"content":84},[85],{"type":16,"content":86},[87],{"text":88,"type":20},"every Admin panel user password",{"type":77,"content":90},[91],{"type":16,"content":92},[93],{"text":94,"type":20},"all REST, SOAP and GraphQL integration tokens, deactivated and regenerated",{"type":77,"content":96},[97],{"type":16,"content":98},[99],{"text":100,"type":20},"OAuth client secrets for connected third-party applications",{"type":77,"content":102},[103],{"type":16,"content":104},[105],{"text":106,"type":20},"payment gateway API credentials, at the provider",{"type":77,"content":108},[109],{"type":16,"content":110},[111],{"text":112,"type":20},"database credentials",{"type":77,"content":114},[115],{"type":16,"content":116},[117],{"text":118,"type":20},"SSH and deploy keys, plus any cron or system service account",{"type":77,"content":120},[121],{"type":16,"content":122},[123],{"text":124,"type":20},"API keys for shipping, tax and other integrated extensions",{"type":16,"content":126},[127],{"text":128,"type":20},"That is a real afternoon of work, and it touches things that break deployments when you get them wrong. Which is exactly why most shops will apply the patch, see a clean scan, and stop.",{"type":37,"attrs":130,"content":131},{"level":39},[132],{"text":133,"type":20},"Why the rotations are the point",{"type":16,"content":135},[136],{"text":137,"type":20},"The bug gave an unauthenticated attacker code execution on your server. Anything that server could read, they could read. That includes the encryption key, and the encryption key is what protects everything else on the list.",{"type":16,"content":139},[140,142,147],{"text":141,"type":20},"Sansec, who found it, put it plainly: ",{"text":143,"type":20,"marks":144},"patching closes the hole but does not clean a store that was already hit",[145],{"type":146},"bold",{"text":148,"type":20},". Stores were being attacked for three days before the hotfix existed. A patch applied today does nothing about a credential taken on Friday.",{"type":16,"content":150},[151],{"text":152,"type":20},"So the question is not whether you are patched. It is whether anyone had a shell on your server between 4 and 7 September, and if you cannot answer that with evidence, you rotate.",{"type":37,"attrs":154,"content":155},{"level":39},[156],{"text":157,"type":20},"Do this in order",{"type":16,"content":159},[160],{"text":161,"type":20},"Scan first. If you patch before you look, you lose the easiest evidence.",{"type":163,"content":164},"code_block",[165],{"text":166,"type":20},"grep -ril 'x_trace_' var\u002Freport\u002F",{"type":16,"content":168},[169],{"text":170,"type":20},"Then apply the hotfix, then rotate. Maintenance mode on and cron off for the middle of it, as Adobe sets out. And if the scan finds anything at all, stop and treat it as an incident rather than a patch job.",{"type":37,"attrs":172,"content":173},{"level":39},[174],{"text":175,"type":20},"The short version",{"type":16,"content":177},[178],{"text":179,"type":20},"Adobe fixed it. That closes the door. It does not tell you who came through while it was open, and it does not take back the keys they picked up on the way.",{"type":16,"content":181},[182],{"text":183,"type":20},"Patch today. Rotate this week. Scan before both.","CVE-2026-75650 is fixed, but Adobe’s own remediation list runs to fourteen steps and eight of them are credential rotations. The patch is the easy half.","blog_post","2026-09-08 06:28","adobe-patched-stylesmuggler-step-1-of-14","blog\u002Fadobe-patched-stylesmuggler-step-1-of-14",null,-170,[],false,215738016545577,"a956fc8f-740d-4eae-ad9d-73f13801558f","default",[]]