Adobe Rushes Emergency Fix as Magento "StyleSmuggler" Zero-Day Backdoors Servers

A Max-Severity Zero-Day, Exploited Before the Patch Landed

Adobe has shipped an emergency out-of-band fix for CVE-2026-75650, a maximum-severity zero-day dubbed "StyleSmuggler" affecting Magento Open Source and Adobe Commerce. E-commerce security firm Sansec discovered the flaw after finding it already being exploited in the wild — attackers have been using it to plant backdoors on live stores since at least September 4, 2026, days before Adobe's fix shipped.

The vulnerability is an arbitrary code execution flaw that Sansec traced to PHP code injection through Magento's email template system: attackers craft a fraudulent "payment failed" notification that smuggles executable PHP into the template rendering pipeline, achieving remote code execution on the underlying server.

Affected Versions

Sansec's initial reporting described the flaw as affecting all versions of Magento and Adobe Commerce, underscoring how deeply the vulnerable template code path is embedded in the platform.

Two Attack Chains, Two Different Payloads

Researchers have observed at least two distinct threat actors racing to exploit StyleSmuggler with different payloads:

Primary Backdoor: A Disguised Rust Implant

The more sophisticated intrusion drops a small Rust-based backdoor that runs as a background process and actively disguises itself as legitimate system activity:

• Early samples masqueraded as the kernel worker process [kworker/u:8:0]
• Newer variants instead pose as fc-cache, planted in ~/.cache/fontconfig/
• Persistence is maintained via a cron job that runs every 30 minutes
• Command-and-control traffic is disguised as NTP requests over UDP port 123, and the backdoor's C2 host is dressed up to look like a regular Network Time Protocol server
• The intrusion leaves one observable trace on the storefront itself: a fraudulent "Payment Transaction Failed Reminder" email — the same template abused for the initial injection

Secondary Attack: A Lightweight PHP Web Shell

A separate threat actor has been observed deploying a much simpler 485-byte PHP web shell through the same vulnerability. This payload is reconnaissance-focused: it collects server information and checks media directory write permissions, apparently to stage a follow-on data exfiltration or persistence step rather than establishing the same level of stealth as the Rust backdoor.

Timeline

Remediation

Adobe and Sansec are urging Magento and Adobe Commerce operators to treat this as an active-incident response, not a routine patch cycle:

1. Install the VULN-39341 hotfix immediately.
2. Enable maintenance mode before patching to prevent further exploitation during remediation.
3. Suspend cron jobs while investigating — the Rust backdoor's persistence mechanism relies on a cron entry, so leaving cron running during cleanup risks re-establishing the implant.
4. Rotate all credentials, including: administrator passwords, GraphQL tokens, OAuth secrets, payment gateway credentials, database credentials, SSH keys, and API keys.
5. Flush cache and restore normal operations only after confirming the environment is clean.
6. Disable GraphQL as a temporary mitigation if the hotfix cannot be applied immediately.

Hunting for Compromise

Why This Matters

StyleSmuggler is a reminder of how attractive e-commerce platforms remain as backdoor targets: a compromised storefront gives attackers a foothold with direct access to payment flows, customer PII, and admin credentials, all sitting behind a public-facing web server that most organizations patch on a slower cadence than internet-facing infrastructure. The gap between "actively exploited since September 4" and "patch available September 8" also means every unpatched Magento or Adobe Commerce instance should be treated as a potential incident, not a theoretical risk.

References

• BleepingComputer — Adobe fixes critical Magento zero-day exploited to backdoor servers
• BleepingComputer — Magento StyleSmuggler zero-day exploited to deploy Linux backdoor

Related Reading

• Zimbra ZCS OS Command Injection
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+