Emerging ThreatsMalware & Ransomware

Adobe patches exploited Magento zero-day used to backdoor servers

Analyst 207||Source: BleepingComputer
Rows of computer servers and networking equipment in a brightly-lit data center with a focused server interface.

CVE-2026-75650 — a max-severity zero-day dubbed StyleSmuggler — has been exploited in the wild since at least September 4, and Adobe released an emergency fix after researchers found attackers using the flaw to plant backdoors on Magento and Adobe Commerce servers.

CVE-2026-75650 (StyleSmuggler): Adobe’s advisory and affected versions

Adobe’s security advisory confirms the vulnerability and its active exploitation. “This update resolves a critical vulnerability that could result in arbitrary code execution. Adobe is aware of CVE-2026-75650 being exploited in the wild,” the advisory states. The vendor assigned the update the highest priority rating and recommends immediate installation of the VULN-39341 hotfix.

Adobe lists the affected product versions explicitly: Adobe Commerce 2.4.4 through 2.4.9 (including the August 2026 releases and earlier releases in each branch); Adobe Commerce B2B 1.3.3 through 1.5.3 (including August 2026 releases and earlier); and Magento Open Source 2.4.6 through 2.4.9 (including August 2026 releases and earlier). Adobe warns the hotfix has only been tested against the August 2026 releases of the affected branches and that compatibility with other releases has not been confirmed.

Sansec’s findings: backdoor behavior and telltale signs

Research from e-commerce security company Sansec shows attackers have used the flaw to install a backdoor on compromised sites. The backdoor disguises its command-and-control (C2) host as a regular Network Time Protocol (NTP) server, while leaving distinct operational traces on infected hosts. One such visible artifact reported by Sansec is the appearance of “Payment Transaction Failed Reminder” emails on compromised systems.

Sansec’s timeline places exploitation activity at least as early as September 4, prompting Adobe’s emergency response and the vendor guidance for administrators to take immediate steps after patching.

Second wave: a 485-byte PHP web shell and Interactsh-style exfiltration

In an update to its original report, Sansec observed a second, unrelated attacker exploiting CVE-2026-75650 to deploy a compact 485-byte PHP web shell. According to Sansec, that shell performs basic reconnaissance — collecting server details and checking whether the pub/media location is writable — and then exfiltrates data via requests to an oast.site subdomain. Sansec notes that oast.site usage is typically associated with security testing that uses the open-source Interactsh tool.

Immediate remediation: VULN-39341 hotfix and required post-patch steps

Adobe’s recommended immediate action is to install the VULN-39341 hotfix. Beyond installing the hotfix, Adobe advises a set of post-patch operations that administrators should perform to reduce the risk of persistent access:

  • Enable maintenance mode.
  • Suspend cron jobs.
  • Rotate all secrets, including administrator passwords, GraphQL integration tokens, OAuth client secrets, payment gateway API credentials, database credentials, SSH keys, and API keys.
  • After rotation, flush the cache, restore cron execution, and disable maintenance mode.

Adobe’s guidance cautions that the hotfix’s compatibility with releases other than the August 2026 builds has not been validated, which administrators must factor into their deployment planning.

What this means for technologists, enterprises, and security teams

Technologists and security teams: apply the VULN-39341 hotfix promptly and follow Adobe’s prescribed maintenance-mode workflow to reduce the window for attackers to retain or regain access. Sansec’s observation of multiple, distinct exploit toolsets — a concealed NTP-disguised C2 backdoor and a second PHP web shell — underscores active weaponization across at least two attack approaches.

Affected enterprises and procurement leaders: inventory Magento and Adobe Commerce instances against the exact version ranges Adobe published, prioritize patching those within 2.4.4–2.4.9 (and the stated B2B and Open Source ranges), and plan for credential and secret rotation as part of recovery budgets and timelines.

Security operations and incident responders: note the specific signs Sansec reported — the NTP-disguised C2 and “Payment Transaction Failed Reminder” email artifacts — and treat unvalidated or unexpected outbound requests to oast.site domains as potential indicators of exfiltration tied to this web-shell activity.

Adobe’s emergency update and Sansec’s follow-up together paint a compact, urgent picture: an actively exploited, high-severity flaw in widely used e-commerce software, multiple exploitation toolsets in play, and clear operational steps for remediation. The Blue Report 2026 — cited in the underlying bulletin — cautions that “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply,” a reminder that rotation of credentials and secrets is not ancillary but central to recovery.

Administrators and security teams should treat the VULN-39341 hotfix and Adobe’s post-patch procedures as immediate priorities and assume that both the NTP-disguised backdoor and small PHP web shells are viable attack methods until evidence shows otherwise.

Source: BleepingComputer — Adobe fixes critical Magento zero-day exploited to backdoor servers

E-CommerceEmerging ThreatsSupply ChainVulnerability ManagementZero-DayMagentoArbitrary Code ExecutionAdobe CommerceStylesmugglerCVE-2026-75650
Related Intelligence

Continue Reading

Two phones on a plain surface, one still and one recently ringing.

WeChat Zero-Click Flaw Exploited to Hijack Accounts via Incoming Calls

A security firm, Calif, has successfully demonstrated a zero-click worm that can hijack WeChat accounts on both iPhone and Android devices with just an incoming call, and fortunately, the exploit has been blocked for all users. This alarming vulnerability was responsibly disclosed to Tencent in July, putting an end to the threat.

Analyst 207
Business office setting with computers and papers, one screen showing a blurry login page.

Microsoft 365 Phishing Op Exposes Thousands of Credentials

A recent phishing operation exposed a staggering 5,137 records from 461 organizations, including 1,032 plaintext passwords and 474 fully authenticated Microsoft 365 sessions that could be easily exploited. This massive haul highlights the alarming vulnerability of sensitive credentials to clever phishing tactics.

Analyst 207
Software development workstation with laptop, monitor, and notes in a modern office setting.

Threat Actors Target AI Coding Tools in Software Supply Chain Compromises

Threat actors are increasingly targeting AI coding tools to compromise software supply chains, with financially motivated groups like UNC6780 using malware like Dustmaker to gain initial access to AI environments. This growing trend highlights the need for heightened security measures in modern AI development pipelines.

Analyst 207
Blurred hospital corridor with secure door and workstation in foreground.

Google Warns of AI Data Extortion Surge

Google's top analyst warns that AI data has become a prime target for extortionists, with companies willing to pay up to keep their valuable intellectual property under wraps. Attackers are exploiting this vulnerability, as seen in recent breaches at a healthcare firm and an AI media generation company.

Analyst 207