An online store holds customer accounts, payment pages and third-party code, so one weak layer reaches shoppers quickly. This page covers the platforms most stores run on (Magento and Adobe Commerce, WooCommerce, Shopify, Shopware) and the incidents, patches and checks that matter this month. Facts below were checked on 24 October 2026.
What matters right now
- Two Adobe Commerce bugs are in CISA's catalog. CVE-2026-75650 was added on 8 September and CVE-2026-71362 on 24 September, per the Known Exploited Vulnerabilities catalog. Adobe fixed the second in bulletin APSB26-92 on 11 August, and a version number alone does not show the patch is applied.
- StyleSmuggler needs a hotfix, then key rotation. Adobe's APSB26-146 covers CVE-2026-75650, and Adobe says it is aware of exploitation in the wild.
- Magento 2.4.6 passed regular support on 11 August 2026. Adobe's release lifecycle page lists 2.4.7, 2.4.8 and 2.4.9 as fully supported, with 2.4.4 and 2.4.5 security-only until 31 May 2027.
- PHP2Shell applies to every PHP store. The php-src advisory lists fixes in 8.5.12, 8.4.27, 8.3.36 and 8.2.35, disclosed 21 October 2026.
- Shopify app incidents redirected shoppers in October. Vendors such as Logbase say an unauthorised script was added to the Selleasy app on 13 October, per its incident notice. Shopify has published no account of its own that we found.
Where to start
- If you run Magento or Adobe Commerce, start with the Magento security checklist.
- If you are unsure which release still gets patches, read the version support dates.
- If you need to prove the August fix is on, follow the APSB26-92 patch check.
- If your store may have been hit by the September bug, see the StyleSmuggler hotfix and rotation order.
- If you suspect injected checkout code on Magento, use the skimmer find-and-respond guide.
- If you run Magento on PHP, verify the runtime for PHP2Shell.
- If you run WooCommerce, read the PHP runtime patch guide, then the skimmer check.
- If failed orders are spiking, work through the card testing steps, and add a CSP that keeps checkout working.
- If you run Shopify, use the checkout hijack checklist and the delisted app checklist.
- If you run Shopware, see what the Security Plugin fixes.
The free scan on Red by run.cloud reads the stack your store serves and matches versions to known vulnerabilities. It can say a version is affected, not whether your setup is exposed or a patch is applied.