Shared on Mage Dispatch · 09 Sep 2026
Offers 41 version-specific patches that backport the official StyleSmuggler (CVE-2026-75650) hotfix to unsupported 2.2.0–2.4.3-p3, with apply steps and guidance on mandatory credential rotation after patching.
Root-cause patch that restricts directive signing to explicitly deferred directives (like inlinecss), preventing signatures on unresolved directives exploited in the StyleSmuggler chain. Includes ready-to-apply patches for versions 2.4.5–2.4.9 and instructions for using composer-patches/cweagans.
Ports the StyleSmuggler (CVE-2026-75650, CVSS 10.0) hotfix with added hardening, includes September isolated patch APSB26-138, and fixes four bugs. Provides remediation guidance for possible compromises and notes ACL and template/block policy changes that may affect previews and custom directives.
Official bulletin for APSB26-138 detailing impacted versions, severity ratings, CVEs, and fixed releases. Only partial content was accessible during fetch; open the link for full details.
Mage Dispatch is a community-run archive and bi-weekly newsletter for the Magento, Adobe Commerce and Mage-OS ecosystem. Modules, articles, security advisories and tools, hand-picked by developers and shared so good work does not disappear into the void.
Browse the latest links → Explore by topic → Submit a link → About us →
Mage-OS