Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Hackers Exploit Magento StyleSmuggler Vulnerability to Deploy PSK Agent RAT

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Attackers exploited CVE-2026-75650 in Magento stores from September 9-13 2026 to deploy PSK Agent RAT before Adobe hotfix.

Attackers exploited the critical StyleSmuggler flaw in Magento and Adobe Commerce, tracked as CVE-2026-75650, between September 9 and 13 2026 to run unauthenticated remote code execution and install the PSK Agent RAT with command execution, host reconnaissance, SOCKS5 proxying and persistence. Imperva observed five clusters using similar PHP payloads against /paypal/transparent/response/ with a dropper URL seen 96 times across 12 variants; some servers also received the zer4.php webshell. The malware targets Magento stores in Western Europe, North America and Asia-Pacific. Administrators must apply Adobe hotfix VULN-39341 but should hunt for persistence and rotate secrets as patching alone is incomplete.

Key facts
  • CVE-2026-75650 StyleSmuggler flaw exploited September 9-13 2026
  • PSK Agent RAT deployed via PHP injection on Magento stores
  • Five clusters with similar payloads tracked by Imperva
  • Dropper seen 96 times across 12 variants
  • Hotfix VULN-39341 issued by Adobe
  • Additional zer4.php webshell planted in some intrusions
Analyze CVE-2026-75650 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Sep 9, 2026Hackers begin exploiting StyleSmuggler vulnerability · GBHackers
  2. Sep 13, 2026Adobe issues emergency hotfix for StyleSmuggler · GBHackers
  3. Nov 3, 2026Reports detail PSK Agent RAT deployment campaigns · Cyber Security News

What each outlet adds

beyond the shared facts
  • GBHackersFive clusters with PHP payloads against /paypal/transparent/response/, 96 dropper instances in 12 variants, Chinese-speaking operator comments, 3313-byte psk_agent.sh dropper and 910-line webshell…
  • Cyber Security NewsTargeting regions Western Europe, North America and Asia-Pacific, automated scanning observed, hotfix closes entry point but does not remove planted malware
CVEs
CVE-2026-75650
Vendors
Adobe
Products
MagentoAdobe CommerceCommerce
Malware
PSK Agentchi_down
Organizations
ImpervaSansecZscaler

Coverage

oldest first · one row per article · UTC
  1. · 23h ago GBHackersFirst report

    Magento StyleSmuggler exploited to deploy PSK Agent RAT

    CVE-2026-75650, scored 10.0, was hit September 9–13, 2026, before Adobe’s emergency hotfix, across stores in three regions.

  2. · 22h ago Cyber Security News

    Adobe Commerce and Magento StyleSmuggler Zero-Day Exploited for RAT Deployment

    Attackers use StyleSmuggler flaw to install PSK Agent RAT and maintain remote access on Magento stores.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-75650
Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650)
10.04%KEVPoC ×2
KEV