Today’s Field Note

The queue is thick with active exploitation today, so triage accordingly. Adobe’s CVE-2026-75650 (“StyleSmuggler,” CVSS 10.0) hits every version of Magento and Adobe Commerce, and Sansec traced in-the-wild abuse back to September 4, with attackers dropping a Rust backdoor, PHP web shells, and a Linux implant. In parallel, MikroTik RouterOS boxes with SSH exposed to the internet are being taken over without a password, and N-able quietly patched a critical N-central zero-day, telling admins to hunt for unfamiliar user accounts. Two of these three are your edge and your management plane, which is exactly where you do not want a foothold you missed.

Today’s Action

  • Patch Adobe Commerce/Magento for CVE-2026-75650 now; if you cannot, apply Adobe’s mitigation and treat any instance internet-facing since September 4 as potentially compromised.
  • Hunt Magento hosts for the StyleSmuggler indicators: unexpected Rust binaries, new PHP files in web roots, and outbound connections consistent with the reported backdoor.
  • Pull MikroTik RouterOS off the internet-facing SSH port, update to fixed firmware, and rotate credentials; assume compromise on any box that had SSH exposed.
  • Apply N-able’s N-central patch and audit for newly created or unrecognized admin accounts, then review recent job/task history for tampering.
  • Given the shared theme, sweep all remote-management tooling (RMM, network gear, e-commerce admin) for anomalous accounts and sessions.

Resources

Verified links for the CVEs mentioned above: official advisories, and a live search for public detection rules if any exist yet.

Your edge is somebody’s foothold. Check it before they do.

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @itsalreadywhen or subscribe via RSS.