Reported by 13 outlets

Timeline

1. original reporting

   StyleSmuggler: a Magento zero-day, CVE-2026-75650, delivering a Rust backdoor and a PHP web shell. Two payloads means two eviction problems.

   threat-intelligence.redeyesecurity.com · 35d ago · September 8th, 2026

   StyleSmuggler: a Magento zero-day, CVE-2026-75650, delivering a Rust backdoor and a PHP web shell. Two payloads means two eviction problems.

   via Mastodon https://threat-intelligence.redeyesecurity.com/blog/stylesmuggler-magento-zero-day-cve-2026-75650

2. update from cyberpress.org

   Hackers Exploit StyleSmuggler Magento and Adobe Commerce Zero-Day for Unauthenticated RCE

   cyberpress.org · 36d ago · September 7th, 2026

   A newly disclosed actively exploited zero-day vulnerability in Magento and Adobe Commerce allows unauthenticated attackers to execute code remotely on affected e-commerce stores. The flaw, named StyleSmuggler, was discovered by Sansec’s Forensics Team, which warned that exploitation began on September 4. The issue is currently unpatched and impacts all supported Magento and Adobe Commerce versions, including Magento Open Source 2.4.9. Sansec reproduced the complete unauthenticated attack chain on clean Magento Open Source installations of 2.4.7, 2.4.8, and 2.4.9. Hackers Exploit StyleSmuggler Magento and Adobe Commerce Zero-Day Sansec also identified a victim running Magento 2.4.6-p15 with July and August 2026 security patches installed, despite the system reporting a clean security:patch-status result. StyleSmuggler abuses Magento’s template system and uses styles properties to evade existing safeguards. The exploit operates in two stages. Attackers first inject, or poison, PHP code into Magento-generated content , potentially by triggering a failure report. They then cause Magento to render that poisoned content through a failed payment email workflow. The injected code executes while Magento renders the standard “Payment Transaction Failed Reminder” email. A recipient does not need to open the email for exploitation to occur, because execution happens server-side during template rendering. The attack may also succeed if the email cannot be delivered, meaning the absence of

3. update from gbhackers.com

   Magento and Adobe Commerce StyleSmuggler 0-Day RCE Actively Exploited in Attacks

   gbhackers.com · 36d ago · September 7th, 2026

   Sansec’s Forensics Team reported that attacks began on September 4, targeting internet-facing […] The post Magento and Adobe Commerce StyleSmuggler 0-Day RCE Actively Exploited in Attacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from securityweek.com

   Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

   securityweek.com · 36d ago · September 7th, 2026

   Threat actors are exploiting a zero-day vulnerability in Adobe Commerce and Magento e-commerce platforms to backdoor online stores, cybersecurity firm Sansec reports. The remote code execution (RCE) flaw works on Magento versions 2.4.7, 2.4.8 and 2.4.9, and has been exploited against deployments running the July and August 2026 patches, Sansec says. Written in Rust, the backdoor was seen connecting to a command-and-control (C&C) server and waiting for commands. On September 6, a second version of the backdoor emerged, disguising itself as ‘fc-cache’. The malware hides its C&C communication as NTP server replies. Its messages carry host information, including agent ID, hostname and username, memory and disk usage, OS version, uptime, root access, and implant version. It also identifies the store’s public IP before beaconing to the C&C. “StyleSmuggler deliberately triggers Magento’s standard ‘Payment Transactio

5. update from malware.news

   StyleSmuggler: Unpatched Magento and Adobe Commerce Zero-Day Exploited

   malware.news · 36d ago · September 7th, 2026

   Dutch e-commerce security firm Sansec discovered the flaw, named StyleSmuggler , and published an early advisory on September 5, 2026, warning that online stores were already being compromised. What Is StyleSmuggler? The flaw allows an attacker to execute arbitrary code on a store’s server without any authentication, then install a persistent backdoor. No CVE identifier or CVSS score has been assigned. Adobe’s security bulletin index lists nothing after the late August 2026 updates. Sansec has not yet published the full exploit chain, and public technical details remain limited. In the first stage, the attacker plants PHP code in a file that Magento itself writes, such as a failure re

6. update from bleepingcomputer.com

   Magento StyleSmuggler zero-day exploited to deploy Linux backdoor

   bleepingcomputer.com · 36d ago · September 7th, 2026

   The first exploitation incident was recorded on September 4 on a target running the latest security updates. E-commerce security company Sansec says that Adobe Enterprise Support confirmed earlier today that it was working on a fix but did not provide a timeline for its release. Magento is a popular open-source e-commerce platform by Adobe installed on more than 160,000 websites, including 14,000 of the top 1 million sites. Successful exploitation installs a small Rust-based backdoor as a background process, disguised as [kworker/u:8:0]. Newer versions disguise the process as fc-cache and copy it to ~/.cache/fontconfig/fc-cache. According to Sansec researchers, the attacker also adds a cron job configured to repeat every 30 minutes for persistence. Although Sansec did not observe any follow-on activity, the malware can communicate with remote infrastructure and receive commands. The researchers note that earlier samples of the backdoor used TLS/WebSockets to communicate with the command-and-control (C2) address, while newer versions disguise their traffic as Network Time Protocol (NTP). They send UDP packets to port 123 and use hostnames th

7. update from bleepingcomputer.com

   Adobe fixes critical Magento zero-day exploited to backdoor servers

   bleepingcomputer.com · 35d ago · September 8th, 2026

   However, it still leaves distinct signs of activity on compromised hosts, such as "Payment Transaction Failed Reminder" emails. “This update resolves a critical vulnerability that could result in arbitrary code execution. Adobe notes that the flaw impacts the following versions of its e-commerce products: Adobe Commerce versions 2.4.4 through 2.4.9, including their August 2026 releases and earlier versions in each branch Adobe Commerce B2B versions 1.3.3 through 1.5.3, including their August 2026 releases and earlier versions in each branch Magento Open Source versions 2.4.6 through 2.4.9, including their August 2026 releases and earlier versions in each branch The vendor assigned the highest priority rating for the update and recommends installing the VULN-39341 hotfix immediately to address CVE-2026

8. mentioned by www.bleepingcomputer.com

   Adobe fixes critical Magento zero-day exploited to backdoor servers https:// bleepingcomputer.com/news/security/ adobe-fixes-critical-magent

   www.bleepingcomputer.com · 35d ago · September 8th, 2026

9. update from socprime.com

   CVE-2026-75650: Adobe Patches Actively Exploited Magento Zero-Day Used to Deploy Backdoors

   socprime.com · 35d ago · September 8th, 2026

   Tracked as CVE-2026-75650 and rated 10.0 on the CVSS scale, the flaw enables unauthenticated remote code execution on vulnerable e-commerce servers. Because exploitation requires no valid Magento account or user interaction, internet-facing stores running vulnerable builds should be treated as high-priority targets for patching and retrospective investigation. CVE-2026-75650 analysis Adobe classifies the vulnerability as CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine . Its CVSS vector indicates network-based exploitation, low attack complexity, no privileges, and no user interaction, with potentially high impact to confidentiality, integrity, and availability. The most important details for CVE-2026-75650 concern the way Magento turns attacker-controlled data into executable PHP during normal application p

10. mentioned by socprime.com

    CVE-2026-75650: Adobe Patches Actively Exploited Magento Zero-Day Used to Deploy Backdoors Indicators extracted from public reporting. Sourc

    socprime.com · 35d ago · September 8th, 2026

11. update from helpx.adobe.com

    Update: Adobe released an update for CVE-2026-75650 yesterday https:// helpx.adobe.com/security/produ cts/magento/apsb26-146.html . CSO: Ado

    helpx.adobe.com · 35d ago · September 8th, 2026

    Update: Adobe released an update for CVE-2026-75650 yesterday https:// helpx.adobe.com/security/produ cts/magento/apsb26-146.html .

12. update from www.bleepingcomputer.com

    🤖 CVE-2026-75650 (StyleSmuggler): max-severity Adobe Commerce/Magento zero-day, exploited in the wild since Sep 4. Backdoor hides its C2 as

    www.bleepingcomputer.com · 35d ago · September 8th, 2026

    🤖 CVE-2026-75650 (StyleSmuggler): max-severity Adobe Commerce/Magento zero-day, exploited in the wild since Sep 4.

13. update from securityweek.com

    Adobe Patches Over 170 Vulnerabilities, Including Commerce Zero-Day

    securityweek.com · 35d ago · September 8th, 2026

    According to Sansec’s updated report , several threat actors have been targeting the vulnerability to deploy backdoors and web shells. Commerce/Magento should apply Adobe’s fixes as soon as possible and rotate their encryption keys and all credentials protected with those keys, including administrative passwords, database credentials, integration tokens, OAuth secrets, SSH and deploy keys, and API keys. Rotating the encryption key on its

14. mentioned by thehackernews.com

    🤖 CVE-2026-75650 (CVSS 10.0): Adobe Commerce & Magento 0-day "StyleSmuggler" exploited in the wild since Sep 4, 2026. Unauthenticated flaw u

    thehackernews.com · 35d ago · September 9th, 2026

15. update from helpx.adobe.com

    Magento and Adobe Commerce shops had three days of exposure last week. Sansec, a Dutch e-commerce security firm, found a template injection

    helpx.adobe.com · 34d ago · September 9th, 2026

    Magento and Adobe Commerce shops had three days of exposure last week.

16. mentioned by suriq.io

    🔴 EXPLOITED Magento and Adobe Commerce have a max-severity zero-day (CVE-2026-75650). Attackers ran code on stores days before a fix existed

    suriq.io · 34d ago · September 9th, 2026

17. mentioned by securebulletin.com

    StyleSmuggler Zero-Day Leaves Every Current Magento and Adobe Commerce Store Exposed to Takeover # CyberSecurity https:// securebulletin.com

    securebulletin.com · 29d ago · September 14th, 2026

18. mentioned by hackread.com

    Hackers are actively exploiting the critical # StyleSmuggler zero-day to compromise Adobe Commerce and Magento stores, with researchers find

    hackread.com · 28d ago · September 15th, 2026

19. update from dev.to

    StyleSmuggler: How a Payment Failure Email Became a Remote Code Execution Path in Magento A storefront can pass every routine security check

    dev.to · 24d ago · September 19th, 2026

    StyleSmuggler: How a Payment Failure Email Became a Remote Code Execution Path in Magento A storefront can pass every routine security check

    via Mastodon https://dev.to/stark_zhuang_df5076f35c68/stylesmuggler-how-a-payment-failure-email-became-a-remote-code-execution-path-in-magento-2ho0