ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
The Hacker Newspublished ()ingested [email protected] (The Hacker News)

Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

criticalExploit / PoC exploited in the wildimportance 92CVE-2026-75650
AI summary · glm-5.3

Adobe patches actively exploited Magento zero-day CVE-2026-75650 (CVSS 10.0), abused since Sept 4 to deploy a Rust backdoor and PHP web shells.

Adobe released an emergency hotfix (VULN-39341) for CVE-2026-75650 (CVSS 10.0), dubbed StyleSmuggler by Sansec, which abuses Magento's template system via PHP code injection to trigger unauthenticated remote code execution in Adobe Commerce and Magento Open Source. Exploitation began September 4, 2026, with attackers deploying a Rust-based Linux backdoor and a PHP dropper that writes a web shell; one managed server was compromised 50 minutes after the first report. Previdian honeypots recorded 12 exploitation attempts from two unique IPs in China and Romania since September 7, all unsuccessful. Adobe urges merchants to apply the patch and rotate encryption keys.

  • CVE-2026-75650 scores 10.0; exploited in the wild since Sept 4
  • StyleSmuggler turns Magento templates into unauthenticated RCE chain
  • Rust Linux backdoor and PHP web shell deployed against merchants
  • Affects Adobe Commerce/Magento Open Source 2.4.4 through 2.4.9
  • Patch requires VULN-39341 and encryption key rotation
Read the original
Tagsadobemagentozero-dayrcestyle-smugglerweb-shellbackdoor

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2026-75650
Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650)

Adobe Commerce and Magento (including Adobe Commerce B2B) contain an improper neutralization of special elements used in a template engine (CWE-1336), a template-injection flaw that permits arbitrary code execution in the context of the current user. The flaw is reachable over the network by unauthenticated attackers, requires no user interaction, and its changed scope (CVSS 3.1 S:C) means injected code executes beyond the vulnerable component, producing a maximum-severity (CVSS 10.0) remote code execution condition. A successful attacker gains arbitrary code execution on the storefront server; in the observed campaign, intruders installed a Rust backdoor and a PHP web shell (dubbed 'StyleSmuggler') on compromised servers. Any organization running an Adobe Commerce, Adobe Commerce B2B, or Magento storefront is in scope, with internet-facing e-commerce deployments most exposed. Exploitation is confirmed in the wild: the bug was abused as a zero-day before patching and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-09-08.

Do: Apply Adobe's released patches immediately per vendor instructions, prioritizing internet-facing Commerce/Magento storefronts, and ensure compliance with CISA BOD 26-04 timelines for KEV entries. Hunt for 'StyleSmuggler' indicators of compromise, including unexpected Rust backdoor binaries and PHP web shells on hosts, and review template/theme customizations for tampering. Exact fixed version numbers are not included in the available data, so consult Adobe's advisory for the correct patched release for your Commerce/Magento version line.

10.02% KEV PoC
  • Adobe Commerce
  • Adobe Commerce B2B
  • Adobe Magento (open-source)
massroughly 100,000-300,000 internet-facing storefronts

Indicators of compromiseAll →

TypeIndicatorContext
domainmagento.comtfix's available for download from the following link: repo.magento[.]com/patch/VULN-39341-composer-patches.zip "To help resolve th
Full article396 words · extracted from thehackernews.com · click to collapse

Ravie LakshmananSep 08, 2026Vulnerability / Web Security

Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild.

The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026.

"This update resolves a critical vulnerability that could result in arbitrary code execution," Adobe said, adding it's "aware that CVE-2026-75650 has been exploited in the wild targeting Adobe Commerce merchants."

At its core, the flaw abuses Magento's template system through PHP code injection to generate a "Payment Transaction Failed Reminder" email, triggering code execution in the process.

The shortcoming affects the following versions -

  • Adobe Commerce
    • 2.4.9-2026-aug and earlier
    • 2.4.8-2026-aug and earlier
    • 2.4.7-2026-aug and earlier
    • 2.4.6-2026-aug and earlier
    • 2.4.5-2026-aug and earlier
    • 2.4.4-2026-aug and earlier
  • Adobe Commerce B2B
    • 1.5.3-2026-aug and earlier
    • 1.5.2-2026-aug and earlier
    • 1.4.2-2026-aug and earlier
    • 1.3.4-2026-aug and earlier
    • 1.3.3-2026-aug and earlier
  • Magento Open Source
    • 2.4.9-2026-aug and earlier
    • 2.4.8-2026-aug and earlier
    • 2.4.7-2026-aug and earlier
    • 2.4.6-2026-aug and earlier

Patches have been released as part of a hotfix's available for download from the following link: repo.magento[.]com/patch/VULN-39341-composer-patches.zip

"To help resolve the vulnerability for the affected products and versions, you must apply the VULN-39341 patch (depending on your version) and rotate your encryption keys," Adobe said.

The development comes days after the Dutch e-commerce security company revealed that threat actors are exploiting CVE-2026-75650 to deploy a Rust-based Linux backdoor that connects to an external server and awaits further instructions. Separately, the issue has been abused to deliver a PHP dropper on susceptible sites that writes a web shell capable of executing arbitrary PHP code.

According to Netherlands-based Disrex, a Magento server managed by the e-commerce development platform is said to have been compromised 50 minutes after the first confirmed StyleSmuggler exploitation was reported on September 4, 2026, at 10:20 p.m. UTC.

"StyleSmuggler turns Magento's own template-processing and dependency-injection code into an unauthenticated remote-code-execution chain," Disrex said.

Telemetry data from Previdian shows that 12 exploitation attempts have been recorded against its honeypots since September 7, 2026, from two unique IP addresses from China and Romania. That said, the efforts have been unsuccessful, Founder and CEO Ryan Dewhurst said.

Update

The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on September 8, 2026, added CVE-2026-75650 to its Known Exploited Vulnerabilities (KEV) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to apply the fixes by September 11, 2026.

In tandem, Adobe has also released patches for more than 170 vulnerabilities across its products, including CVE-2026-82004 (CVSS score: 10.0), an operating system command injection flaw in Campaign Classic leading to arbitrary code execution.

Also patched by Adobe are two critical vulnerabilities in ColdFusion CVE-2026-48273, CVSS score: 9.9, and CVE-2026-75746, CVSS score: 9.1) that could result in arbitrary code execution. The web design software maker said it's not aware of any exploits in the wild for any of these issues.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html