Adobe Commerce (Magento) and PHP stack breach guide
Published 4 Nov 2026 · Updated 2026-11-04
If your store runs Adobe Commerce or Magento Open Source 2.4.x, make sure the August 2026 security patch (2.4.x-2026-aug) and the separate hotfix for CVE-2026-75650 are installed. CISA lists three 2026 Commerce vulnerabilities as exploited in the wild, including one rated 10.0 that needs no login. Your PHP version needs patching too.
Who this is for: Australian retailers and brands running a Magento 2 or Adobe Commerce store, in-house or through an agency. Written by our collective of Melbourne web and app developers; facts checked against NVD, the CISA KEV catalog and vendor advisories on 2026-11-04. Free to use and share.
Book a free stack check Already breached? First steps
Supported versions
Adobe Commerce / Magento
Adobe ships monthly security patches for each supported 2.4.x line (named like 2.4.8-2026-aug) and occasional out-of-band hotfixes. Adobe's bulletins list 2.4.4 to 2.4.9 (Commerce) and 2.4.6 to 2.4.9 (Open Source) as the lines receiving fixes in 2026. Anything older is not getting patches.
Source: Adobe Commerce / Magento official lifecycle (checked 2026-11-04).
PHP
| Branch | Active support | Security support until |
|---|---|---|
| 8.1 and older | — | End of life |
| 8.2 | 2024-12-31 | 2026-12-31 |
| 8.3 | 2025-12-31 | 2027-12-31 |
| 8.4 | 2026-12-31 | 2028-12-31 |
| 8.5 | 2027-12-31 | 2029-12-31 |
Source: PHP official lifecycle (checked 2026-11-04).
Loose Content Security Policy and permissive CORS
What the issue is
A Content Security Policy (CSP) tells browsers which scripts a page may run. Many stores ship it in report-only mode, or allow 'unsafe-inline' and 'unsafe-eval', so the browser logs problems but blocks nothing. Separately, a Cross-Origin Resource Sharing (CORS) setup that reflects any requesting origin while also sending Access-Control-Allow-Credentials: true lets any website make logged-in requests to your API and read the answers.
Why it matters
Checkout skimming works by injecting a script that copies card and address fields as customers type. An enforced, tight CSP is one of the few browser-side controls that can stop that script running or sending data out. Permissive CORS with credentials can expose customer account data, carts and admin API responses to a malicious site a logged-in user happens to visit.
How to fix it
- Inventory the scripts your storefront and checkout actually load (payment, analytics, tag manager) and list their domains.
- Move the CSP from report-only to enforced, starting with the checkout pages, and allow only those domains in script-src and connect-src.
- Remove 'unsafe-eval', and replace 'unsafe-inline' with nonces or hashes for the inline scripts you need.
- Keep a report-uri/report-to endpoint so you can see violations after enforcing.
- For CORS, allow an explicit list of trusted origins only; never echo back an arbitrary Origin header together with Access-Control-Allow-Credentials: true, and never combine credentials with a wildcard.
- Retest with your browser's developer tools and confirm unknown origins get no Access-Control-Allow-Origin header.
Sources: MDN: Content Security Policy · MDN: CORS · OWASP CSP Cheat Sheet · OWASP: Testing CORS
Key high and critical CVEs for this stack
These are recent high or critical vulnerabilities. "KEV" means CISA lists it as known to be exploited in the wild.
| CVE | Component | Affected | Fixed in | CVSS | KEV |
|---|---|---|---|---|---|
| CVE-2026-75650 | Adobe Commerce / Magento: Template-engine injection allowing unauthenticated arbitrary code execution | Commerce 2.4.4 to 2.4.9 and Open Source 2.4.6 to 2.4.9, up to the 2026-aug patch level | Hotfix for CVE-2026-75650 (APSB26-146) | 10.0 (CVSS 3.1, Adobe) | Yes (added 2026-09-08) |
| CVE-2026-71362 | Adobe Commerce / Magento: Incorrect authorization giving unauthenticated access to sensitive resources | 2.4.4 to 2.4.9, up to the 2026-jul patch level | 2.4.x-2026-aug (APSB26-92) | 9.1 (CVSS 3.1, Adobe) | Yes (added 2026-09-24) |
| CVE-2026-48356 | Adobe Commerce / Magento: Unrestricted upload of dangerous file types, can lead to code execution | 2.4.9, 2.4.8-p5, 2.4.7-p10, 2.4.6-p15 and earlier | 2.4.x-2026-jul (APSB26-73) | 9.6 (CVSS 3.1, Adobe) | Yes (added 2026-10-27) |
| CVE-2026-109618 | PHP: Out-of-memory handling memory corruption leading to unauthenticated remote code execution | 5.x/7.3 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 (7.3.0+ per NVD) | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2026-109619 | PHP: Stale internal request state leading to unauthenticated remote code execution | 5.4.0 up to 8.2.34, 8.3.0–8.3.35, 8.4.0–8.4.26, 8.5.0–8.5.11 | 8.2.35, 8.3.36, 8.4.27, 8.5.12 | 9.2 (CVSS 4.0, PHP) | Yes (added 2026-10-26) |
| CVE-2024-4577 | PHP: PHP-CGI argument injection on Windows (Apache + PHP-CGI, certain code pages) | 8.1 before 8.1.29, 8.2 before 8.2.20, 8.3 before 8.3.8 | 8.1.29, 8.2.20, 8.3.8 | 9.8 (CVSS 3.1, PHP) | Yes (added 2024-06-12) |
How attacks on this stack typically work
- Attackers watch Adobe's bulletins and scan for stores still on older patch levels; exploitation of Commerce flaws has historically started within days of release.
- Code-execution bugs are used to plant web skimmers: JavaScript added to checkout that copies card and address details as customers type.
- Authorization bypasses expose customer and order data through the REST API without a login.
- Malicious files uploaded through vulnerable endpoints act as backdoors that survive a later patch, so check for compromise, not just update.
Patch and hardening steps
- Find your exact versions. Ask your developer or agency for the output of bin/magento --version and the list of applied patches (composer.lock, or the Quality Patches Tool status). In Adobe Commerce Admin the version also shows in the footer.
- Back up first (files and database), and keep the backup off the server.
- Update Adobe Commerce / Magento to at least: Hotfix for CVE-2026-75650 (APSB26-146); 2.4.x-2026-aug (APSB26-92); 2.4.x-2026-jul (APSB26-73). Move off any end-of-life branch.
- Update PHP to at least: 8.2.35, 8.3.36, 8.4.27, 8.5.12; 8.1.29, 8.2.20, 8.3.8. Move off any end-of-life branch.
- Remove unused plugins, apps, themes and accounts, and turn on automatic updates for minor and security releases where available.
- Lock down admin: Use a custom Admin URL, enforce two-factor authentication for every Admin user, restrict Admin by IP where possible, and remove old agency and staff accounts.
- Check for signs of compromise after patching a KEV-listed flaw: unknown admin users, unexpected new files on the server, changed checkout or header scripts.
- Follow a patching cadence. The ACSC's Essential Eight treats patching applications as a core mitigation.
What this means for your industry
Online stores hold customer names, addresses, phone numbers and order history, which is personal information under the Privacy Act. If a breach is likely to cause serious harm, you may need to notify customers and the OAIC: see what to do after a data breach.
Melbourne or Victorian public-sector supplier? See Melbourne and Victorian breach contacts. We will cover reported incidents involving these technologies in our Australian breach news.
Want a second pair of eyes on your stack?
Book a short call and one of our developers will talk through your versions and patch plan. No pressure, no scare tactics.
Frequently asked questions
Which Adobe Commerce flaws are being exploited right now?
CISA's KEV catalog lists CVE-2026-75650 (added 8 Sep 2026), CVE-2026-71362 (24 Sep 2026) and CVE-2026-48356 (27 Oct 2026). Adobe's bulletins APSB26-146, APSB26-92 and APSB26-73 give the fixes. Source
Is the monthly patch enough for CVE-2026-75650?
No. Adobe's bulletin lists 2.4.x-2026-aug and earlier as affected and the fix is a separate hotfix, so check it is applied on its own. Source
We use Adobe Commerce Cloud. Are we patched automatically?
Not necessarily. Adobe's bulletins list Adobe Commerce on all platforms as affected, and patches are applied by deploying updated code. Confirm with your agency. Source
I think my store was already compromised. What first?
Preserve logs, rotate Admin and integration credentials, check checkout pages for unknown scripts, report to the ACSC and assess whether the Notifiable Data Breaches scheme applies. Source
Related stack guides
- Drupal and PHP stack breach guide
- Next.js, React and Node.js stack breach guide
- PHP + WordPress stack breach guide
- Shopify store security guide
- Silverstripe CMS, PHP and jQuery stack breach guide
- Webflow and hosted CMS security guide
- WordPress, PHP and Node.js stack breach guide
- WooCommerce, WordPress and PHP stack breach guide
- All stack security guides
Sources
- helpx.adobe.com/security/products/magento.html
- nvd.nist.gov/vuln/detail/CVE-2026-75650
- helpx.adobe.com/security/products/magento/apsb26-146.html
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-75650
- nvd.nist.gov/vuln/detail/CVE-2026-71362
- helpx.adobe.com/security/products/magento/apsb26-92.html
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-71362
- nvd.nist.gov/vuln/detail/CVE-2026-48356
- www.adobe.com/trust/security/products/commerce/apsb26-73.html
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48356
- www.php.net/supported-versions.php
- nvd.nist.gov/vuln/detail/CVE-2026-109618
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109618
- github.com/php/php-src/security/advisories/GHSA-w8hw-w9fx-j79w
- www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
- nvd.nist.gov/vuln/detail/CVE-2026-109619
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-109619
- github.com/php/php-src/security/advisories/GHSA-6wmf-4rv5-p3rp
- nvd.nist.gov/vuln/detail/CVE-2024-4577
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4577
- www.php.net/ChangeLog-8.php
- sansec.io/research/polyshell-mass-attack-wave
- www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight
General information only, not legal or professional advice. Versions and CVEs change quickly; always confirm against the vendor before acting.