Today’s Field Note

Three unauthenticated pre-auth problems land on the same day, and none of them wait for your change window. Sansec’s StyleSmuggler is an unpatched zero-day in Magento Open Source and Adobe Commerce that runs code on the storefront server with no login, with active exploitation since September 4 and no vendor fix yet. CERT Polska separately warns that internet-exposed MikroTik SSH is being taken over for full admin with no authentication, hits confirmed from September 2. And JetBrains, the people who make TeamCity, got breached through their own unpatched TeamCity and are now telling Cadence users to rotate every credential, which is a useful reminder that “we shipped the patch” and “we applied the patch” are different sentences.

Today’s Action

  • Magento/Adobe Commerce: apply Sansec’s StyleSmuggler mitigations now, hunt for unexpected admin users, injected template code, and new files under app/ and pub/ since September 4.
  • MikroTik: pull SSH off the public internet immediately, restrict to management VLAN or VPN, then audit for unknown admin accounts, scripts, and scheduled tasks.
  • TeamCity: confirm you are actually patched against the recently disclosed critical flaw, not just downloaded it, and check exposure to the internet.
  • If you run Cadence or any TeamCity-driven pipeline, revoke and rotate all credentials and secrets, especially AWS keys, per JetBrains’ guidance.
  • Log every one of these external services and diff against a known-good baseline before you trust a clean scan.

Patched and applied are two different words. Check which one you actually did.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.