CTI · corroborated · 2026-09-09

StyleSmuggler: a Magento zero-day, CVE-2026-75650, delivering a Rust backdoor and a PHP web shell

Full story & timeline

Actors

—

Malware / tools

StyleSmuggler Rust backdoor

Campaigns

StyleSmuggler

CVEs

CVE-2026-75650

Victim sectors

e-commerceretail

Geography

—

MITRE ATT&CK

T1190 Exploit Public-Facing Application Initial Access
T1505 Server Software Component Persistence
T1100 Web Shell Persistence
T1105 Ingress Tool Transfer Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: StyleSmuggler Magento CVE-2026-75650 Exploitation — PHP Template Injection
id: c3d4e5f6-a7b8-4c9d-0e1f-2a3b4c5d6e7f
status: experimental
description: Detects exploitation of CVE-2026-75650 (StyleSmuggler), an unauthenticated RCE in Adobe Commerce and Magento Open Source. Attackers inject PHP through the Payment Transaction Failed Reminder email template path to achieve code execution as the web server user.
references:
  - https://threat-intelligence.redeyesecurity.com/blog/stylesmuggler-magento-zero-day-cve-2026-75650
  - https://helpx.adobe.com/security/products/commerce/apsb26-58.html
author: Tia N. List
date: 2026/09/09
tags:
  - attack.t1190
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-uri-query|contains:
      - 'email/shipment'
      - 'email/transaction'
      - 'template/transport'
      - 'payment/reminder'
    cs-method: POST
  condition: selection
falsepositives:
  - Legitimate Magento email template processing
level: critical

YARA-X raw

rule StyleSmuggler_Rust_Backdoor {
    meta:
        author = "Tia N. List"
        date = "2026/09/09"
        status = "experimental"
        description = "Detects the StyleSmuggler Rust-compiled Linux backdoor deployed via CVE-2026-75650 Magento exploitation"
        reference = "https://threat-intelligence.redeyesecurity.com/blog/stylesmuggler-magento-zero-day-cve-2026-75650"
        falsepositives = "Unknown"
    strings:
        $rust1 = "rustc" ascii
        $rust2 = ".cargo" ascii
        $path1 = "/tmp/" ascii
        $path2 = "/var/www/" ascii
        $payload1 = "curl" ascii
        $payload2 = "wget" ascii
        $payload3 = "bash -c" ascii
        $elf = { 7F 45 4C 46 }
    condition:
        $elf at 0 and ($rust1 or $rust2) and ($path1 or $path2) and ($payload1 or $payload2 or $payload3)
}

References

Source on GitHub