Shared on Mage Dispatch · 16 Sep 2026

StyleSmuggler APSB26-146: What the Patch Changes and What's Still Vulnerable

Breaks down the APSB26-146/VULN-39341 hotfix: neutralizing payloads in error reports, restricting email template data types, adding admin preview ACL checks, and validating block types before instantiation. Clarifies why disabling GraphQL wasn't enough, covers the additional Bigbridge directive-signing patch, and shares practical steps for applying patches and cleaning compromised stores.

Visit link → https://m.academy/articles/magento-stylesmuggler-apsb26-146-security-patch/

#security-patch #StyleSmuggler

More like this

Removing Fastly Edge Rules Blocking Admin CMS Saves (CVE-2026-75650)

Fixes 403s on admin page/block saves by identifying and removing Fastly VCL snippets (accord-rce, accord_rce_1) via the CLI, with steps to clone, validate, and activate a clean version; also covers applying the real CVE-2026-75650 patch or scoping a storefront-only rule.

https://dor.ky/post/removing-adobe-fastly-rules-cve-2026-75650-admin-page-save

#Fastly #security #admin #security-patch #StyleSmuggler

11 Sep 2026
CVE-2026-75650: Style Smuggler

Covers how the Style Smuggler vulnerability (CVE-2026-75650) works, how to detect potential compromise, and practical remediation and hardening steps. Note: Content could not be fetched; details inferred from the URL.

https://www.graycore.io/case-studies/CVE-2026-75650-style-smuggler

#StyleSmuggler #vulnerability #security #security-patch

10 Sep 2026
StyleSmuggler Deferred Directives Fix

Root-cause patch that restricts directive signing to explicitly deferred directives (like inlinecss), preventing signatures on unresolved directives exploited in the StyleSmuggler chain. Includes ready-to-apply patches for versions 2.4.5–2.4.9 and instructions for using composer-patches/cweagans.

https://github.com/bigbridge-nl/magento2-stylesmuggler-deferred-directives-fix

#StyleSmuggler #security-patch #templates #composer-patches

09 Sep 2026

New here? This is Mage Dispatch

Mage Dispatch is a community-run archive and bi-weekly newsletter for the Magento, Adobe Commerce and Mage-OS ecosystem. Modules, articles, security advisories and tools, hand-picked by developers and shared so good work does not disappear into the void.

Browse the latest links → Explore by topic → Submit a link → About us →

StyleSmuggler APSB26-146: What the Patch Changes and What's Still Vulnerable

More like this

Removing Fastly Edge Rules Blocking Admin CMS Saves (CVE-2026-75650)

CVE-2026-75650: Style Smuggler

StyleSmuggler Deferred Directives Fix

New here? This is Mage Dispatch

Never miss what's new in Magento land