Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Adobe patches actively exploited Magento zero-day CVE-2026-75650 (CVSS 10.0), abused since Sept 4 to deploy a Rust backdoor and PHP web shells.
Adobe released an emergency hotfix (VULN-39341) for CVE-2026-75650 (CVSS 10.0), dubbed StyleSmuggler by Sansec, which abuses Magento's template system via PHP code injection to trigger unauthenticated remote code execution in Adobe Commerce and Magento Open Source. Exploitation began September 4, 2026, with attackers deploying a Rust-based Linux backdoor and a PHP dropper that writes a web shell; one managed server was compromised 50 minutes after the first report. Previdian honeypots recorded 12 exploitation attempts from two unique IPs in China and Romania since September 7, all unsuccessful. Adobe urges merchants to apply the patch and rotate encryption keys.
- CVE-2026-75650 scores 10.0; exploited in the wild since Sept 4
- StyleSmuggler turns Magento templates into unauthenticated RCE chain
- Rust Linux backdoor and PHP web shell deployed against merchants
- Affects Adobe Commerce/Magento Open Source 2.4.4 through 2.4.9
- Patch requires VULN-39341 and encryption key rotation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-75650 | Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650) | 10.0 | 4% | KEVPoC ×2 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | magento.com | tfix's available for download from the following link: repo.magento[.]com/patch/VULN-39341-composer-patches.zip "To help resolve th |
From the original article
2 min read at thehackernews.com
Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10. 0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026.
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.