Good morning. The weekend brought a running e-commerce emergency with no patch to install, a dark web listing that turned an identity verification vendor into everybody’s problem, and a court fight over whether a dead company gets to sell its employees’ work email to an AI lab. Underneath most of it is the same uncomfortable question, which is how much of your risk lives in systems you do not own and never chose. Here are the five stories that matter most if you are running a small or midsize business, or leading its IT.
Attackers spent the weekend backdooring Magento and Adobe Commerce stores through a zero-day that has no patch and no CVE. Dutch e-commerce security firm Sansec disclosed the flaw, which it named StyleSmuggler, on Friday after attacks began the night before, and said it published early because stores were being compromised in real time. The attack needs no login, plants PHP code in a log file Magento writes itself, and then gets the platform to execute that file by triggering a routine “Payment Transaction Failed Reminder” email, leaving behind a Rust binary disguised as a Linux kernel thread with a cron job that restarts it every five minutes. The part merchants need to hear is that patch level did not help: the first confirmed victim was running the newest security updates Adobe offers for its release line, and a hosting provider that handled two compromises said both were fully current on the paths that mattered. Adobe had published nothing as of Sunday and its next scheduled security release is Tuesday, so if you sell online through Magento or Adobe Commerce, this morning is a conversation with whoever hosts that store about disabling GraphQL and checking for the indicators, not a wait-and-see. It is also a reminder that “we are patched” is a weaker sentence than most of us treat it as. Read more at The Hacker News
Digital scans of more than 153 million American and Canadian driver’s licenses went up for sale on a new dark web service, and the trail leads back to an identity verification vendor most of those people never heard of. The FBI’s New Orleans field office has opened an investigation into an apparent breach at IDScan.net, a company that processes more than 21 million identity verifications a month for roughly 20,000 locations including well-known retail, rental and hospitality brands. The listing, hosted on a Russian cybercrime forum, offers over 170 million North American records in total, and each driver’s license entry reportedly includes six images: the front and back of the license as a plain scan plus infrared and ultraviolet versions of the same. Investigative reporter Brian Krebs connected the data to IDScan.net by tracing records tied to identified victims. If your business asks a customer for ID at check-in, at pickup, at the point of sale, or as part of an age check, you are almost certainly using a service like this one, and the exposure it creates belongs to you even though the systems do not. Worth knowing this week: which vendor performs that scan, how long they retain the image, and whether your contract says anything at all about it. Read more at CSO Online
Researchers published 39 separate ways to compromise an account protected by passkeys, none of which require breaking the cryptography. The point of the work is that a passkey login crosses an unusual number of trust boundaries on its way to succeeding, including the web application, the browser, the operating system, the password manager, the cloud sync service, the phone, the Bluetooth transport, the enrollment process, the account recovery path, the help desk, and the person clicking approve. The catalog includes assertion replay, assertion phishing, browser hooking, challenge injection, and malware on a compromised endpoint that simply calls the passkey APIs itself, spams the user with prompts until one gets approved, or dresses up the request to look like it came from a trusted app. None of this makes passkeys a bad idea, and they remain a large upgrade over passwords and text message codes. What it does mean is that if you are rolling passkeys out this year, the weak points are almost certainly your account recovery process and your help desk, because those are where an attacker goes once the front door is genuinely locked. Write down how someone actually gets back into an account after losing a phone, and see whether the answer is a process or a favor. Read more at BleepingComputer
A bankrupt airline’s internal email is now the subject of a bidding war between AI companies, and its former employees are in court trying to stop it. Spirit Airlines stopped flying in May, and the corporate data it left behind, roughly 600 million email and chat records from 17,000 employees along with 17 million OneDrive files, 20.5 million SharePoint items and more than 30 million recorded customer service calls, went to Google at a bankruptcy auction for $10 million. AI data company Micro1 has since come in at $12.5 million, and the flight attendants’ union has filed to block the sale on the grounds that decades of personal and workplace records are being sold to train AI models while former staff still have not been paid out for accrued vacation and sick time. Anonymizing the data is on the table as a compromise. This one is not a security story so much as a preview, because every business is now generating the same kind of archive, and almost none of us have thought about what happens to it if the company is sold, wound down, or acquired by someone with different plans. Your employment agreements, your vendor contracts, and your data retention policy were written before internal chat logs had a market price. That is worth a look. Read more at Computerworld
Google shipped an emergency Chrome update on Friday for a zero-day that attackers are already using. CVE-2026-85046 is a type confusion flaw in V8, the JavaScript engine at the center of Chrome, rated 8.8, and a malicious web page is enough to get code running inside the browser. Google confirmed an exploit exists in the wild but is holding back details while the fix rolls out, and it is the sixth Chrome zero-day exploited in the wild this year. The patched builds are 152.0.7977.82 and .83 on Windows and macOS and 152.0.7977.82 on Linux, and the same fix flows into Edge, Brave and the other Chromium browsers on their own schedules. The reason this is worth a paragraph rather than a shrug is that Chrome updates on relaunch, and a meaningful share of your staff have not closed their browser in weeks. Pushing the update centrally, or just asking everyone to restart Chrome and confirm the version, is a five minute task that closes the most-used application in your business against something being exploited right now. Read more at Help Net Security
Sponsored by Lucky 13 Solutions
Business in Motion. Tech in Sync. Lucky 13 Solutions is a managed services provider helping small and midsize businesses keep their IT reliable, secure, and well-supported, without needing a full in-house team. Learn more at l13s.com.
If you run a Magento or Adobe Commerce store, start there, and have everyone else restart Chrome.
Get the Business IT News Roundup in your inbox:
How this gets made: stories come from my own reading and from AI-assisted research and drafting, all reviewed and edited by me before anything goes out. The commentary is mine, sources are linked so you can read the original, and any errors are mine to own. If something looks wrong, reply and tell me.