Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Summary: Adobe released patches on Monday for CVE-2026-75650, a maximum-severity (CVSS 10.0) flaw in Adobe Commerce and Magento Open Source that Sansec codenamed StyleSmuggler and traced to zero-day exploitation starting September 4, 2026. The flaw abuses Magento's template system through PHP code injection to generate a "Payment Transaction Failed Reminder" email and trigger code execution, and has been used to deploy a Rust-based Linux backdoor and a PHP dropper that writes a web shell.
Why it matters: Disrex reported a Magento server was compromised 50 minutes after the first confirmed StyleSmuggler exploitation was reported, and CISA added the flaw to its KEV catalog on September 8, 2026, with a September 11 deadline for federal agencies.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2026-48273CVE-2026-75650CVE-2026-75746CVE-2026-82004
- Related
- CVE-2026-75650: Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability Known Exploited Vulnerabilities · Sep 08, 2026Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026