A technical analysis by ZDI describes three flaws that it says are part of CVE-2026-35273 in Oracle PeopleSoft. Oracle released a fix in June, while the vulnerability had already been actively exploited.
CISA has added the critical CVE-2026-48356 vulnerability in Adobe Commerce and Magento Open Source to its Known Exploited Vulnerabilities catalog. Fixes have been available since July.
GitLab fixed a critical unauthenticated vulnerability enabling remote code execution. Administrators of self-managed CE and EE instances should prioritize updating.
Alongside CVE-2026-108097 in Field UI, Drupal fixed a separate critical RCE vulnerability, CVE-2026-108099, in the Entity List module. Affected websites should update the module to version 3.0.10.
Security firm VulnCheck has recorded attempts to exploit a flaw in Rejetto HFS 3.x that could allow an attacker to forge an administrator session and execute code on the server.
TechCrunch observed a “Buy” button for selected Flipkart products among some users in India in the Gemini and AI Mode interfaces. Google did not confirm Flipkart’s specific involvement.
The U.S. agency CISA lists a critical vulnerability in Adobe Commerce, Adobe Commerce B2B and Magento Open Source as actively exploited. Patches have been available since August.
Sansec has published additional technical details about the actively exploited StyleSmuggler vulnerability in Magento Open Source and Adobe Commerce. According to the analysis, the attack can lead to PHP code execution and the deployment of a persistent process on the server.