Online shops running Magento Open Source and Adobe Commerce were attacked through a security hole before Adobe had a fix, says Dutch e-commerce forensics firm Sansec. It's called the bug StyleSmuggler. It lets attackers run their own code on a shop's server without logging in. Attacks have been seen since 4 September 2026, and versions 2.4.4 through 2.4.9 are affected. As of Sansec's last update, at 21:30 UTC on 6 September, Adobe still hadn't published an advisory, a CVE number or an official fix.