Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell
Adobe released patches for CVE-2026-75650 (CVSS 10.0), a maximum-severity zero-day in Adobe Commerce and Magento Open Source enabling unauthenticated remote code execution The vulnerability, codenamed StyleSmuggler by Sansec, exploits Magento's template system via PHP code injection to trigger arbitrary code execution during email generation Threat actors are actively exploiting the flaw to deploy a Rust-based Linux backdoor and a PHP web shell dropper on compromised servers Exploitation was fir
Analysis
TL;DR
- Adobe released patches for CVE-2026-75650 (CVSS 10.0), a maximum-severity zero-day in Adobe Commerce and Magento Open Source enabling unauthenticated remote code execution
- The vulnerability, codenamed StyleSmuggler by Sansec, exploits Magento's template system via PHP code injection to trigger arbitrary code execution during email generation
- Threat actors are actively exploiting the flaw to deploy a Rust-based Linux backdoor and a PHP web shell dropper on compromised servers
- Exploitation was first confirmed on September 4, 2026, with a Disrex-managed Magento server compromised within 50 minutes of public disclosure
- Adobe advises affected users to apply the VULN-39341 hotfix patch and rotate encryption keys immediately
Why It Matters
This vulnerability represents a critical threat to the e-commerce ecosystem, as Magento powers a significant portion of online retail infrastructure worldwide. The rapid real-world exploitation—within hours of discovery—demonstrates how zero-days in widely deployed platforms can be weaponized at scale, making timely patching a top priority for security teams and platform administrators.
Technical Details
- Vulnerability mechanism: CVE-2026-75650 abuses Magento's template-processing and dependency-injection code to inject PHP payloads through a "Payment Transaction Failed Reminder" email, achieving unauthenticated RCE without requiring any credentials
- Affected versions: Adobe Commerce 2.4.4 through 2.4.9 (2026-aug and earlier), Adobe Commerce B2B 1.3.3 through 1.5.3 (2026-aug and earlier), and Magento Open Source 2.4.6 through 2.4.9 (2026-aug and earlier)
- Malware payloads: Two distinct attack vectors observed in the wild—a Rust-based Linux backdoor that connects to an external C2 server and awaits instructions, and a PHP dropper that writes a persistent web shell for ongoing arbitrary code execution
- Patch details: Adobe released hotfix VULN-39341 (available at repo.magento.com/patch/VULN-39341-composer-patches.zip); remediation requires both applying the patch and rotating encryption keys
- Exploitation telemetry: Previdian recorded 12 exploitation attempts from two unique IPs (China and Romania) against honeypots since September 7, 2026, all unsuccessful; Disrex reported a confirmed compromise 50 minutes after initial disclosure
Industry Insight
- The speed of exploitation (50 minutes to first confirmed compromise) underscores the necessity of automated vulnerability management and proactive patching pipelines—organizations should treat CVSS 10.0 flaws as emergency-level incidents requiring immediate action
- The use of a Rust-based backdoor is notable, as Rust is increasingly favored by threat actors for its performance, memory safety, and difficulty of reverse engineering; security teams should update threat intelligence feeds to include Rust binary indicators of compromise
- E-commerce platform operators should audit their Magento deployments immediately, verify patch application across all affected versions, and rotate all encryption keys as a mandatory remediation step rather than an optional recommendation
Disclaimer: The above content is generated by AI and is for reference only.