Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

CVE-2026-75650

September 8, 2026 · The Hacker News · Severity: CRITICAL

This article reports that Adobe has patched a critical zero-day in Magento and Commerce, exploited to deploy a Rust backdoor and PHP web shell. The flaw, dubbed StyleSmuggler, allows unauthenticated code execution via template injection. 📌 **Analyst Note:** The use of a Rust backdoor indicates sophisticated threat actors; defenders should check for unusual processes and web shells, and rotate all encryption keys after patching.

Adobe on Monday released security patches to address a maximum-severity flaw impacting AdobeCommerce andMagento Open Source that has come under active exploitation in the wild. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026. "This update resolves a critical vulnerability that could result in arbitrary code execution," Adobe said , adding it's "aware that CVE-2026-75650 has been exploited in the wild targeting Adobe Commerce merchants." At its core, the flaw abuses Magento's template system through PHP code injection to generate a "Payment Transaction Failed Reminder" email, triggering code execution in the process. The shortcoming affects the following versions - Adobe Commerce 2.4.9-2026-aug and earlier 2.4.8-2026-aug and earlier 2.4.7-2026-aug and earlier 2.4.6-2026-aug and earlier 2.4.5-2026-aug and earlier 2.4.4-2026-aug and earlier Adobe Commerce B2B 1.5.3-2026-aug and earlier 1.5.2-2026-aug and earlier 1.4.2-2026-aug and earlier 1.3.4-2026-aug and earlier 1.3.3-2026-aug and earlier Magento Open Source 2.4.9-2026-aug and earlier 2.4.8-2026-aug and earlier 2.4.7-2026-aug and earlier 2.4.6-2026-aug and earlier Patches have been released as part of a hotfix's available for download from the following link: repo.magento[.]com/patch/VULN-39341-composer-patches.zip "To help resolve the vulnerability for the affected products and versions, you must apply the VULN-39341 patch (depending on your version) and rotate your encryption keys," Adobe said . The development comes days after the Dutch e-commerce security company revealed that threat actors are exploiting CVE-2026-75650 to deploy a Rust-based Linux backdoor that connects to an external server and awaits further instructions. Separately, the issue has been abused to deliver a PHP dropper on susceptible sites that writes a web shell capable of executing arbitrary PHP code. According to Netherlands-based Disrex, a Magento server managed by the e-commerce development platform is said to have been compromised 50 minutes after the first confirmed StyleSmuggler exploitation was reported on September 4, 2026, at 10:20 p.m. UTC. "StyleSmuggler turns Magento's own template-processing and dependency-injection code into an unauthenticated remote-code-execution chain," Disrex said. Found this article interesting? Follow us on Google News , Twitter and LinkedIn to read more exclusive content we post.

Key Takeaways

CVE-2026-75650 is a maximum-severity flaw in Adobe Commerce and Magento Open Source, actively exploited since September 4, with a CVSS score of 10.0 and codenamed StyleSmuggler.
The vulnerability abuses Magento's template system through PHP code injection to generate a payment failure email, triggering arbitrary code execution without authentication.
Attackers are exploiting CVE-2026-75650 to deploy a Rust-based Linux backdoor and a PHP web shell on compromised sites, enabling persistent remote access.