The latest in Magento land
Do you know that feeling? You worked long and hard on that blog post? Or that super wicked Magento extension? And then you hit publish and... nothing. No one reads it. No one sees it. It just sits there. Well, not anymore! Mage Dispatch is here to help you get your content out there.
Mage Dispatch is a newsletter for the community and by the community. Here you can share links that you think that the community should know about. We will include it in our next newsletter.
Happening now
StyleSmuggler
Critical unauthenticated RCE in the Magento template engine, CVSS 10 and actively exploited. Install both patches below right now, then check your store for compromise.
-
https://github.com/bigbridge-nl/magento2-stylesmuggler-deferred-directives-fix
Root-cause patch that restricts directive signing to explicitly deferred directives (like inlinecss), preventing signatures on unresolved directives exploited in the StyleSmuggler chain. Includes ready-to-apply patches for versions 2.4.5–2.4.9 and instructions for using composer-patches/cweagans.
-
Mage-OShttps://mage-os.org/releases/2026-09-08-mage-os-3-5-0-release/
Ports the StyleSmuggler (CVE-2026-75650, CVSS 10.0) hotfix with added hardening, includes September isolated patch APSB26-138, and fixes four bugs. Provides remediation guidance for possible compromises and notes ACL and template/block policy changes that may affect previews and custom directives.
-
https://helpx.adobe.com/security/products/magento/apsb26-138.html
Official bulletin for APSB26-138 detailing impacted versions, severity ratings, CVEs, and fixed releases. Only partial content was accessible during fetch; open the link for full details.
-
https://dor.ky/post/adobe-september-2026-monthly-patch-mcloud-15053
Breaks down the September 2026 MCLOUD-15053 patch: fixes rollback ACL, export path traversal, GraphQL customer scope, Instant Purchase address ownership, PayPal Express quote binding, admin VAT XSS, URL escaping, plus B2B UI ACL and validator changes. Covers version-specific differences (2.4.4–2.4.9; B2B 1.3.3–1.5.3) and notes you also need APSB26-146.
-
https://scandiweb.com/blog/stylesmuggler-fix-for-older-magento-versions/
Offers 41 version-specific patches that backport the official StyleSmuggler (CVE-2026-75650) hotfix to unsupported 2.2.0–2.4.3-p3, with apply steps and guidance on mandatory credential rotation after patching.
-
https://github.com/yellowteak/APSB26-146-patches
Pre-split APSB26-146 (VULN-39341) patches tailored for cweagans/composer-patches, organized per 2.4.4-p18 through 2.4.9 with a drop-in patches.json. Covers framework, base, backend, email, and newsletter packages, with steps to apply via Composer.
-
https://gist.github.com/pingiun/00cfbfdc3cf517807eb3b6bc24c7f295
Patch implementing explicit directive deferral and signing in the template filter to block unresolvable directives from being treated as deferred and executed by parent templates. Includes diffs for Framework Template and Email Template Filter, adapted for Composer installs and intended to be applied alongside APSB26-146.
-
https://dor.ky/post/cve-2026-75650-apsb26-patches-analysis
Details how APSB26-146 closes three issues—unsafe object instantiation reachable from CMS/email templates, untyped preview inputs, and writable error reports—and outlines patching steps plus checks to catch similar instantiate-then-check anti-patterns.
-
https://github.com/disrex-group/module-stylesmuggler-guard
Adds interim, application-layer guards against the StyleSmuggler zero-day: validates URL-generator classes, blocks stream-wrapper template paths, sanitizes email template styles, and hardens reports/logs. Includes a block-directive allowlist and optional suppression of failed-payment emails; meant as defense-in-depth until an official fix.
-
https://helpx.adobe.com/security/products/magento/apsb26-146.html
Announces a hotfix for CVE-2026-75650, a critical template engine vulnerability enabling unauthenticated remote code execution (CVSS 10) and known to be exploited. Lists affected 2.4.x and B2B releases and links to installation instructions.
Mage-OS