A critical alert went out for online stores. The real target is your checkout page.

What happened

On 7 September 2026 Adobe released an out-of-band fix (bulletin APSB26-146) for a flaw in Adobe Commerce, Adobe Commerce B2B and Magento Open Source — the software that runs a large number of mid-sized online shops. The flaw, CVE-2026-75650, nicknamed "StyleSmuggler" by the researchers who found it being used, is rated 10.0 on the CVSS scale. That is the maximum. It means an attacker who has never logged in, and who your store has never seen before, can make the store run code of their choosing.

Adobe has said the flaw was being exploited in the wild against merchants. Security firm Sansec traced exploitation back to 4 September — three days before a fix existed — and reported attackers installing web shells and a Linux backdoor on stores they got into. On 9 September 2026, ASD's ACSC published a Critical alert naming small and medium businesses in its audience, and said there is "a substantial number of potentially vulnerable instances within the Australian economy."

Why this matters even if you don't run Magento

Magento is the store in the headline, but it isn't the story. The story is that attackers want checkout pages, and they will use whatever door is open on whatever platform you're running.

The technique has a name — web skimming, or Magecart. Instead of stealing a database, the attacker quietly adds a few lines of JavaScript to the page where customers type their card number. The page looks and works exactly as it did. The order goes through. The customer gets their confirmation email. And a copy of the card number, name, address and CVV goes to the attacker at the same time. Nothing visibly breaks, which is why these infections are often measured in weeks or months before anyone notices.

It isn't a Magento-only problem. Researchers at Confiant tracked one skimming operation that hit more than 40 storefronts across at least fifteen countries since around April 2026 — and found the compromised shops were overwhelmingly WooCommerce, with some PrestaShop, Magento and plain WordPress. In that campaign the loader was tucked inside a Google Tag Manager block so it read like ordinary analytics plumbing to anyone glancing at the page source.

Who this applies to

Any Australian business that takes payment, a booking deposit, or a card number through its own website. That includes online retailers, but also service businesses with a "pay your invoice here" page, clinics taking booking fees, and anyone running a shop plugin on an otherwise ordinary brochure site.

It applies much less if your checkout hands customers straight to a hosted payment provider — a Stripe, Square or PayPal page, or a payment field that provider supplies and controls — because then the card number never passes through code on your own server. That is a genuinely meaningful difference, and it's check five below.

Seven checks worth doing this week

The part people skip: the patch isn't the whole job

This week's alert is the second serious Adobe Commerce flaw in under a year. The earlier one — "SessionReaper", CVE-2025-54236, rated 9.1 — has been exploited since late 2025, and Sansec's own telemetry suggested roughly three in five stores still hadn't applied that fix weeks after it shipped. That's the number worth sitting with. The vulnerabilities get the headlines; the gap between a fix existing and a fix being applied is what actually gets stores robbed.

If you take one thing from this guide, make it check one. Knowing what your store runs on, and who is responsible for updating it, is what turns the next alert from a fortnight of uncertainty into a ten-minute job.