StyleSmuggler root cause: only sign directives that were explicitly deferred

More like this

• APSB26-146 patches for cweagans/composer-patches

  Pre-split APSB26-146 (VULN-39341) patches tailored for cweagans/composer-patches, organized per 2.4.4-p18 through 2.4.9 with a drop-in patches.json. Covers framework, base, backend, email, and newsletter packages, with steps to apply via Composer.

  https://github.com/yellowteak/APSB26-146-patches

  #security-patch #composer #cweagans-composer-patches #StyleSmuggler

  08 Sep 2026

• CVE-2026-75650 / APSB26-146 Patch Analysis

  Details how APSB26-146 closes three issues—unsafe object instantiation reachable from CMS/email templates, untyped preview inputs, and writable error reports—and outlines patching steps plus checks to catch similar instantiate-then-check anti-patterns.

  https://dor.ky/post/cve-2026-75650-apsb26-patches-analysis

  #security-patch #vulnerability #di #cms #StyleSmuggler

  08 Sep 2026

• StyleSmuggler Guard Module

  Adds interim, application-layer guards against the StyleSmuggler zero-day: validates URL-generator classes, blocks stream-wrapper template paths, sanitizes email template styles, and hardens reports/logs. Includes a block-directive allowlist and optional suppression of failed-payment emails; meant as defense-in-depth until an official fix.

  https://github.com/disrex-group/module-stylesmuggler-guard

  #security #vulnerability #templates #StyleSmuggler

  08 Sep 2026