Liphutsa Lelinemaphuzu langu-10 kulangu-10 ku-Magento na-Adobe Commerce: Lokwenteka Ngempela

Kucala imphendvulo leccondzile: nga-4 Inyoni 2026, bahlaseli bacala kusebentisa liphutsa lebelingakalungiswa ku-Magento Open Source na-Adobe Commerce, lelibhaliswe njenge-CVE-2026-75650 linemaphuzu ebungoti langu-10.0 — lasetulu kakhulu langaba khona. Leli phutsa livumela kutsi kwentiwe imiyalo eseveni yesitolo ngaphandle kwekungena futsi ngaphandle kwemalungelo nanoma ngumaphi, futsi Adobe yakhipha lilungiso layo ngakusihlwa nga-7 Inyoni. Loko kushiya emalanga lamatsatfu laphelele lapho titolo betivulekile ngaphandle kwekuvikeleka nakancane. Yingako nje kufaka lilungiso kunganeli: nangabe sitolo sakho sisebenta kulenkhundla, kucabanga lokuphephile kutsi kungenteka uhlaselwe ngaphambi kwekutsi lilungiso libe khona, futsi imphendvulo lefanele kufuna timphawu tekungena ngenkhani nekushintja bakhiye bakho bekubetsela kanye nayo yonkhe imininingwane yekungena — hhayi kufaka kuvuselela bese uchubeka nelilanga lakho.

Ngubani lotsintsekako, ngalokuccondzile

Luhlu lubanti ngendlela lengakavami, ngobe lufaka ekhatsi nekukhishwa lokusha kakhulu lebekukhona ngesikhatsi kutfolakala:

  • Magento Open Source na-Adobe Commerce: ema-version 2.4.4 kuya ku-2.4.9, kufaka ekhatsi tonkhe tibuyeketo temalungiso kuze kube nguNcwaba 2026.
  • Adobe Commerce B2B: ema-version 1.3.3 kuya ku-1.5.3, kuze kube sibuyeketo saNcwaba 2026.
  • Nanoma yini lendzala kune-2.4.4: seyivele ingasasekelwa, futsi ngiyo sigaba lesiyingoti kakhulu ngobe i-hotfix lesemtsetfweni ayisimboti.

Kukhuluma ngalokucacile: nangabe nga-1 Inyoni bewusebentisa i-Magento lebeyivuselelwe ngalokuphelele, bewusengotini. Lesi akusiso simo lesijwayelekile sekunganaki lesivame kuxwayisa ngaso — leli yi-zero-day yangempela lebekungekho muntfu lobekanendlela yekuyandvulela.

Indlela kuhlasela lokusebenta ngayo ngaphandle kwephasiwedi

Kuhlasela kwenteka ngetigaba letimbili futsi kusebentisa kabi likhono le-Magento lekwakha emathempulethi ema-imeyili. Esigabeni sekucala, umhlaseli utfumela sicelo lesentiwe ngebuciko endleleni yemphendvulo yekukhokha, futsi konkhe lokukulesicelo kubhalwa efayeleni lembiko wemaphutsa eseveni. Esigabeni sesibili, sicelo lesiya ku-GraphQL endpoint sikhomba kulelo fayela lelinetjefu, futsi lokukulo kuyasebenta ngesikhatsi kulungiswa i-imeyili yekukhumbuta ngekwehluleka kwekukhokha.

Lokufanele kunakwe ngumnikati webhizinisi akusiyo imininingwane yelubuchwepheshe, kodvwa yiloko lokuvetwa yiyo: tindlela letisebaleni letibukeka tingenacala nakancane — imphendvulo yesango lekukhokha, i-endpoint yekubuta yesitolo, i-imeyili letentekelako — tahlangana taba yindlela lephelele leya eseveni. Butsakatsaka lobubucayi abuvamisi kuba sicabha sinye lesivuleke sabanzi; kaningi kakhulu buluchungechunge lwetivalo letincane, lapho ngasinye sibukeka sinengcondvo ngalokuphelele nasisodvwa.

Loko bahlaseli lebakutjala nase bangenile

Lapha kulapho kubonakala khona umehluko emkhatsini welisoka lelibhubhisako nemsebenti lohlelekile. Tinhlelo letimbi letabonwa betingasito tincwadzi letinemsindvo te-ransomware, kodvwa bekungematfuluzi lathulile ekuhlala sikhatsi lesidze:

  • Umnyango wangemuva lobhalwe nge-Rust lotifihla njengenye yetinchubo te-kernel yesistimu yekusebenta, kuze ungabonakali kunoma ngubani lobuka luhlu lwetinchubo ngekushesha.
  • Kuhamba kwedatha yekulawula nekuyala lokufihliwe ngembobo yekuvumelanisa sikhatsi, kuze lomsebenti ubukeke njengekulungisa iwashi lokujwayelekile kumarekhodi enethiwekhi.
  • Ema-web shell e-PHP labhalwe ekhatsi kumafolda e-cache etitfombe temikhicito — tindzawo lekungekho muntfu lovame kutihlola ngobe tigcwele emafayela esikhashana.
  • Ematfuluzi lengetiwe ekungena ukhashane avela kumhlaseli wesibili lonematfuluzi langahlobani, loku kusho kutsi leli phutsa belisetjentiswa ngemacembu langetulu kwalinye ngesikhatsi sinye.

Inhloso yetinhlelo letinjengaleti esitolo se-inthanethi lesatiwako kuhlala sikhatsi lesidze nekufundza idatha yema-oda neyekukhokha njengoba yendlula — hhayi kuwisa iwebhusayithi. Sitolo lesitsheleleko siyachubeka sisebenta ngendlela lejwayelekile ngalokuphelele, futsi leyo yincenye lesabisako.

Kungani kufaka kuvuselela kunganeli

Ngobe nangabe umhlaseli angena ngaphambi kwa-7 Inyoni, nyalo unekhophi yebakhiye bakho bekubetsela kanye nemininingwane yekungena lelondloloziwe. Lilungiso livala sivalo lebangena ngaso; alibakhiphi ekhatsi. Seluleko se-Adobe ngekwayo besicacile kuloku: faka lilungiso bese ushintja bakhiye bekubetsela, emaphasiwedi ephaneli yebaphatsi, ema-API token, imininingwane yekungena yesango lekukhokha, emaphasiwedi e-database kanye nebakhiye bekungena eseveni.

Lilungiso limisa kopha. Kushintja bakhiye yikho lokukhipha sivakashi lesingakamenywa endlini.

Luhlelo lwekutsatsa sinyatselo lolusebentako lwemnikati wesitolo

  • Kwekucala — cinisekisa kutsi lilungiso lifakwe ngempela, hhayi kutsi kukhona lotsite kutsi lifakiwe. Cela licembu lakho bufakazi lobuvela kurekhodi lemalungiso eseveni ngekwayo, hhayi umlayeto lodvudvutako.
  • Kwesibili — hlola imikhondzo yekungena ngenkhani: tinchubo letisolisako letisebentako letinemagama lalingisa tinchubo tesistimu, emafayela e-PHP ekhatsi kumafolda etindzaba netitfombe, kanye nemafayela emibiko yemaphutsa langakavami.
  • Kwesitsatfu — buyeketa lirekhodi lema-imeyili laphumako. Kukhuphuka lokungalindzeleki kwema-imeyili ekukhumbuta ngekwehluleka kwekukhokha kuluphawu loluccondzile lwemetamo yekuhlasela, futsi noma ngumuphi umholi wekusebenta angalufundza ngaphandle kwelwati lolujulile lwekuphepha.
  • Kwesine — shintja wonkhe umkhiye ngaphandle kwekuhlukanisa, ikakhulukati imininingwane yekungena yesango lekukhokha. Loku kudzinga sikhatsi sekulungisa lesihleliwe, hhayi sincumo lesentiwa ngekuphutfuma ngetikhatsi letimatasatasa.
  • Kwesihlanu — nangabe i-version yakho indzala kune-2.4.4, yekela kulindza lilungiso lelisemtsetfweni lelingeke lite. Beka luhlelo lwekuvuselela lolunelusuku lwangempela, futsi okwamanje beka sitolo ngemuva kwe-web application firewall.
  • Kwesitfupha — bhala phasi loko lokwentile. Nangabe kuvela kutsi idatha yemakhasimende iphumile, utawudzinga umugca wesikhatsi waloko lokwentile nekutsi nini.

Luhlangotsi lwemitsetfo eSaudi Arabia: idatha yemakhasimende akusiyo nje indzaba yelubuchwepheshe

Sitolo se-inthanethi lesigcina emagama emakhasimende, emakheli, tinombolo temaselula kanye nemlandvo wema-oda sicubungula idatha yemuntfu lebuswa nguMtsetfo Wekuvikela Idatha Yemuntfu. Kuphulwa kwekuphepha akuhlali kuyindzaba yangekhatsi emkhatsini wesitolo nalowo losiphakela kubamba iwebhusayithi; kudala tibopho kulabaphatsi labafanele kanye nakubanikati bedatha ngekwabo. Ngako-ke umbuto umnikati wesitolo lokufanele awubute lamuhla akusiwo nje "iseva sefakwe lilungiso yini", kodvwa "ngingakhombisa yini kutsi idatha yemakhasimende ami ayizange itsintfwe".

Nangabe sitolo sakho sisebenta enkhundleni ye-cloud leliphatfwako njenga-Salla noma Zid, awukho ngekhatsi kwalelo phutsa lelitsite, ngobe kufaka emalungiso enkhundleni akusiwo umtfwalo wakho. Kodvwa sifundvo lesifanako sisebenta kunoma nguyiphi i-extension noma kuhlanganiswa kwelicembu lesitsatfu losixhumanise nesitolo sakho: umtfwalo wekufaka emalungiso ulandzela loyo lonikati iseva.

Indlela lesiphatsa ngayo tehlakalo letinjengaleti e-Origami

Simiso lesakha ngaso emasistimu emakhasimende kutsi sehlakalo sekuphepha akusiko kwenteka lokukhashane, kodvwa sehlakalo lesihlehlisiwe. Ekwenteni loku kusho tintfo letintsatfu: imininingwane yekungena igcinwa ngaphandle kwekhodi esitolweni lesehlukile kuze kutsi kuyishintja kube ngumsebenti wemizuzu esikhundleni sephrojekthi yeliviki lonkhe; emarekhodi ekusebenta agcinwa ngaphandle kweseva ngekwayo kuze umhlaseli angakhoni kucisha imikhondzo yakhe; kanye nemakhophi ekulondvoloza lahlolwe ngempela ngekubuyiselwa, hhayi nje kuhlelwa.

Futsi nangabe uphatsa sitolo se-Magento ngaphandle kwelicembu lelubuchwepheshe lelinikelwe, sinyatselo lesifanele lamuhla silula: cela lowo lokuphakela kubamba iwebhusayithi noma umlingani wakho welubuchwepheshe umbiko lobhaliwe lophendvula imibuto lemitsatfu kuphela — lilungiso lafakwa nini ncamashi, kuhlola kwekuhlaselwa kwatfolani, nekutsi bakhiye bashintjiwe yini. Leyo mibuto lemitsatfu iveta lokunyenti ngekulungela kwemlingani welubuchwepheshe kunanoma ngukuphi kwetfulwa.

Imitfombo

  • Simemetelo lesisemtsetfweni se-Adobe Commerce mayelana nesibuyeketo sekuphepha i-APSB26-146 kanye ne-hotfix lephutfumako: experienceleague.adobe.com
  • Kuhlatiya kwelubuchwepheshe kwe-Sansec nge-CVE-2026-75650 kanye netimphawu tekuhlaselwa: sansec.io/research/stylesmuggler-0day
  • Luhlu lwe-CISA lwebutsakatsaka lobatiwako kutsi busetjentisiwe: cisa.gov
  • Umtsetfo Wekuvikela Idatha Yemuntfu (PDPL) — Ligunya leSaudi Ledatha Nebuhlakani Bekwakhiwa (SDAIA): sdaia.gov.sa