Emerging ThreatsMalware & Ransomware

Adobe Patches Zero-Day Flaw Exploited to Deploy Rust Backdoor

Analyst 207||Source: TheHackerNews
E-commerce website management dashboard on a laptop screen in a retail setting.

"This update resolves a critical vulnerability that could result in arbitrary code execution," Adobe said, adding it is "aware that CVE-2026-75650 has been exploited in the wild targeting Adobe Commerce merchants."

CVE-2026-75650 and the codename "StyleSmuggler"

Adobe disclosed a maximum-severity vulnerability tracked as CVE-2026-75650 with a CVSS score of 10.0. Security researcher Sansec assigned the exploit the codename StyleSmuggler and reported that zero-day exploitation began on September 4, 2026. Adobe characterized the flaw as capable of enabling arbitrary code execution and said it has seen active exploitation against Adobe Commerce merchants.

How the vulnerability is abused: templates, PHP injection, and a payment reminder

At its core the bug leverages Magento’s template system. The flaw permits PHP code injection inside template processing to generate a “Payment Transaction Failed Reminder” email; that generation path is what triggers remote code execution. Netherlands-based Disrex summarized the technical impact bluntly: "StyleSmuggler turns Magento's own template-processing and dependency-injection code into an unauthenticated remote-code-execution chain."

Observed payloads: a Rust Linux backdoor and a PHP web shell

Security reporting ties active exploitation of CVE-2026-75650 to at least two distinct payload patterns. A Dutch e-commerce security company reported that threat actors have used the flaw to deploy a Rust-based Linux backdoor that connects to an external server and awaits further instructions. Separately, the issue has been abused to deliver a PHP dropper that writes a web shell able to execute arbitrary PHP code on compromised sites.

Affected products, available hotfix, and Adobe's mitigation steps

Adobe listed the affected releases in detail. The flaw impacts these Adobe Commerce releases:

  • 2.4.9-2026-aug and earlier
  • 2.4.8-2026-aug and earlier
  • 2.4.7-2026-aug and earlier
  • 2.4.6-2026-aug and earlier
  • 2.4.5-2026-aug and earlier
  • 2.4.4-2026-aug and earlier

Adobe Commerce B2B affected releases:

  • 1.5.3-2026-aug and earlier
  • 1.5.2-2026-aug and earlier
  • 1.4.2-2026-aug and earlier
  • 1.3.4-2026-aug and earlier
  • 1.3.3-2026-aug and earlier

Magento Open Source affected releases:

  • 2.4.9-2026-aug and earlier
  • 2.4.8-2026-aug and earlier
  • 2.4.7-2026-aug and earlier
  • 2.4.6-2026-aug and earlier

Adobe has issued hotfixes and published patches as VULN-39341. The hotfix bundle is available for download from repo.magento[.]com/patch/VULN-39341-composer-patches.zip. Adobe advised that affected products must apply the VULN-39341 patch (depending on version) and rotate encryption keys as part of remediation.

What this means for technologists, Adobe Commerce merchants, and platform operators

  • Technologists and security teams: apply the VULN-39341 hotfix corresponding to your release and rotate encryption keys as Adobe instructed; be alert for signs of a Rust-based backdoor communicating with external servers and for PHP web shells written by droppers.
  • Adobe Commerce merchants: verify your Magento or Adobe Commerce release against the affected lists above, apply the hotfix from repo.magento[.]com/patch/VULN-39341-composer-patches.zip, and treat any unexplained server behavior or web shells as indicators of compromise given observed deployments.
  • E‑commerce platform operators: prioritize incident checks and forensic review; Disrex reported that a Magento server managed by an e‑commerce development platform was compromised roughly 50 minutes after the first confirmed StyleSmuggler exploitation was reported on September 4, 2026 at 10:20 p.m. UTC.

The combination of an unauthenticated template-based remote code execution chain, a CVSS 10.0 rating, and public reports of rapid compromise and live payloads makes this a critical, time-sensitive issue for sites running the enumerated releases. Adobe has published a hotfix and explicit mitigation steps; for operators of affected installations the next concrete steps named by Adobe are straightforward: apply VULN-39341 and rotate encryption keys, and investigate any evidence of a Rust backdoor or a PHP web shell on systems that matched the affected versions.

Original story: https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html

E-CommerceEmerging ThreatsSupply ChainZero-DayAdobeArbitrary Code ExecutionAdobe CommerceStylesmugglerCVE-2026-75650Rust Backdoor
Related Intelligence

Continue Reading

Dimly lit server room with rack-mounted equipment, cables, and screens displaying abstract content.

Threat Actors Deploy AI Frameworks for Widescale Credential Theft

Threat actors have upgraded their game, leveraging AI frameworks to supercharge credential theft and drastically cut the time between initial compromise and large-scale attacks. Gone are the days of simple, one-off AI prompts - now, attackers are orchestrating entire attacks with sophisticated multi-agent frameworks.

Analyst 207
Smartphone on a cluttered workbench with tools and equipment in a research facility setting.

THost9 Android RAT Exploits Exposed ADB Services to Spread

Meet the sneaky THost9 Android RAT that's exploiting exposed ADB services to spread its reach - and it can scan a massive 65,025-host range with ease.

Analyst 207
Person working at desk with laptop and papers in modern office setting.

BengalSEO Campaign Exploits Bing Search Results

Meet BengalSEO, a notorious group that's been secretly manipulating Bing search results with sneaky Black Hat SEO tactics since at least 2015, luring victims into malware and tech-support scams. They're masters of creating fake support pages that look legit, but actually serve as traps.

Analyst 207
Server room with rows of computer servers and networking equipment.

Microsoft Credentials Targeted in BigBear 2 PhaaS Campaign

Security researchers just uncovered a massive phishing operation targeting Microsoft 365 credentials, with a staggering 5,137 compromised records and 3,331 unique victim IPs exposed. The researchers even gained admin access to the operation's control panel, revealing a vast network of 42 VPS nodes used to carry out the attacks.

Analyst 207