security
Adobe also brought goodies to the patch party and they deserve immediate attention
The vulnpocalypse is upon us, dear reader. Microsoft delivered a record number of patches to address 974 CVEs in its own products this month, including two bugs that Redmond says are already under exploitation.September's record-breaking collection of security updates come after Microsoft served up 421 fixes in August, and 622 in July. We've seen the new normal and we are not impressed. Thanks, but no thanks, AI. In addition to Microsoft’s massive patch drop, Adobe on Tuesday issued 10 bulletins addressing 172 CVEs, including a max-severity vulnerability exploited as a zero day in Magento and its successor product Adobe Commerce. Adobe on Monday shipped a hotfix for this one, tracked as CVE-2026-75650 and named StyleSmuggler, that gives unauthenticated attackers remote code execution.
StyleSmuggler
If your organization has any type of online shop, prioritize this one first as it’s already being abused to compromise stores, according to e-commerce security shop Sansec.Sansec discovered StyleSmuggler, and reports that attacks started on September 4. Every version of Magento and Adobe Commerce, from 2.4.4 up to and including 2.4.9, has the flaw. The bug allows attackers to inject malicious PHP code inside Magento templates using the “styles” properties to evade safety detections. In confirmed attacks, the payload then installs a backdoor that connects to a command-and-control server and waits for instructions. “So far, we have no indication that the backdoor has been weaponized,” the Sansec Forensics Team wrote.Don’t wait to find out on this one. Put it at the top of your mitigation list.Microsoft's 974 CVEsOn to Microsoft’s record-breaking 974 CVEs, which according to Tenable is not many fewer than the 1,130 CVEs Redmond issued in 2025.Two are already being exploited as zero-days.First up: CVE-2026-85880, a privilege escalation bug in Windows Advanced Local Procedure Call (ALPC). Successful exploitation can result in the attacker gaining SYSTEM privileges.
