Last week's round-up was mostly one story, the Magento zero day. This week is the less dramatic half of it, which is where the actual work lives, plus two smaller things that will bite if you are not looking.

StyleSmuggler: patching was the easy bit

A quick recap for anyone who missed it. CVE-2026-75650, which Sansec named StyleSmuggler, is an unauthenticated remote code execution flaw in Magento Open Source and Adobe Commerce, scored 10.0. Exploitation started on 4 September, Adobe shipped the emergency hotfix VULN-39341 on the 7th, and the regular September bulletin APSB26-138 followed on the 8th. Every version from 2.4.4 to 2.4.9 is affected. Sansec's write-up is the primary source.

What has changed this week is the shape of the problem. CrowdSec reports around 500 distinct IPs sending matching requests since 9 September, which is the opportunists arriving after the tooling went public. The flaw is on the CISA known exploited list. And Sansec documented at least one store that had the July and August patches applied and was still compromised, because the hotfix came after the attackers did.

So if you patched on the 7th or 8th and stopped there, you are not done. The three-day window before the hotfix means "am I patched" and "was I compromised" are separate questions. Rotate the encryption key and the admin and integration credentials, check the product image cache directory for PHP files that should not be there (that is where the second attacker in Sansec's report dropped a web shell), and compare the code on disk against a clean copy. Swiss Up Labs has a practical checklist for the check-and-clean part.

I have said this before and I will keep saying it: the stores that come out of weeks like this fine are the ones where somebody owns patching as a job, not a favour. If nobody at your company can tell you the date of your last security patch, that is the finding. What a proper retainer covers is queued for next month and this is the reason it exists.

Supabase: logs.all goes on 23 September

A small one that will break a script somewhere. The Management API endpoint logs.all is being removed on 23 September, and the replacement is the ClickHouse-backed logs endpoint, which takes ClickHouse SQL only. If you have any monitoring, alerting or a cron that pulls logs through the old endpoint, it stops working on Wednesday. The Supabase changelog has the entry.

The typical victim is a little script that pulls auth failures nightly and posts a count somewhere. Moving it is a twenty-minute job if you find out this week, and a confusing Thursday morning if you do not. Worth a grep.

Claude Code's limits: up 25% and down 17%, both true

On 14 September Anthropic changed the weekly usage limits on Claude Code for Pro, Max, Team and seat-based Enterprise plans. The headline was a permanent 25% increase over the pre-promotion standard limit. The follow-up was that, compared with the temporary 50% boost that had been running since May, it works out as a 17% reduction. Index the old standard at 100, the summer boost at 150, and the new level at 125, and both numbers fall out. Digital Applied's post does the arithmetic and is careful about what Anthropic actually said versus what got repeated.

My take: if you only ever hit the ceiling in the summer, you were budgeting against a promotion. Route routine work to the cheaper models and most people will not notice, but if you run a team on it, re-do the seat maths at 125 rather than 150 and stop treating the boost as the baseline. The same week, Claude Code 2.1.271 added fast mode to remote sessions, which for me matters more than the limit change; the changelog has the detail.

What I published this week

Monday was can your team actually edit a headless CMS, which is the question I get asked most by non-technical owners and the one most headless vendors answer badly. Thursday was how to prepare for a headless migration: the content audit, the redirect map and the decision about what not to bring, all of which happen before anyone writes a line of code.

Next week is Monday's replatform or fix your Magento store, which given the last fortnight is landing at about the right time.

One line for the weekend

If you run Magento and have not read the Sansec report properly, do that before anything else. If you run Supabase and have any script that mentions logs.all, fix it before Wednesday. Everything else can wait.