By ByteBot
A CVSS 10.0 zero-day in Magento and Adobe Commerce spent three days in active exploitation before Adobe shipped a fix — and it hit stores that had the August 2026 security patches fully applied. Dutch e-commerce security firm Sansec published their findings early because stores were getting backdoored in real time. The exploit, now tracked as CVE-2026-75650 and named StyleSmuggler, requires zero authentication, and it drops a Rust backdoor that disguises itself as a Linux kernel thread. If you run Magento or Adobe Commerce, the rest of this article is your action checklist.
How StyleSmuggler Gets In
The attack surface is Magento’s email templating engine — specifically the “Payment Transaction Failed Reminder” notification. Attackers inject malicious PHP into the styles properties of a template. Those properties are normally used for CSS-like directives, so they don’t get the same scrutiny as visible user input fields. When Magento renders the email, the injected PHP executes with full application privileges. No credentials required. No specially-crafted user account. Just network access to a public endpoint.
That’s what makes CVSS 10.0 feel earned here rather than inflated. The attack is unauthenticated, exploitable remotely, and fully reproduces on clean installs of Magento 2.4.7, 2.4.8, and 2.4.9 even with current patches applied. The August 2026 security update didn’t touch this code path.
What Gets Dropped on Your Server
Sansec tracked two independent attacker campaigns exploiting the same vulnerability — a signal that multiple threat actor groups weaponized this fast.
Campaign 1: The Rust Backdoor
The primary payload is a Rust-compiled Linux backdoor that impersonates legitimate system processes. Depending on the variant, it runs under [kworker/u:8:0], fc-cache, or chronyd — all names that appear in normal process listings. It installs persistence via cron at irregular intervals (like 13,43 * * * *) to avoid pattern detection. For command-and-control it generates UDP traffic on port 123, disguised as NTP time sync. The C2 domains are typosquats: ntp.timesync.to, ntp.timesysnc.net, time.microsft.run. Each NTP-disguised beacon sends nine UDP datagrams every 60 seconds — legitimate NTP uses one.
Campaign 2: The PHP Web Shell
A separate attacker group used the same bug to drop a PHP web shell under pub/media/catalog/product/cache/. It returns 404 to unauthenticated scanners — only responding to requests carrying a specific X-Cache-Token header. It accepts arbitrary PHP commands via a task POST parameter. The shell hides in a directory that most PHP file scanners don’t check because it’s under the media directory, not the application root.
The Timeline: Three Days With No Patch
Exploitation began September 4 at 22:20 UTC. Sansec’s WAF started blocking attacks by September 5 at 07:15 UTC. Adobe released hotfix VULN-39341 on September 7 at 20:20 UTC — three days and roughly 21 hours after the first confirmed attack. Between those timestamps, the implant evolved twice: renaming to fc-cache (v2.1.4 on September 6), then to chronyd (v2.1.5 on September 7 as a second attacker emerged). CISA added CVE-2026-75650 to its Known Exploited Vulnerabilities catalog on September 8, with a mandatory patching deadline of September 11 for federal agencies. Roughly 160,000 Magento and Adobe Commerce stores were in scope.
Check If You’re Already Compromised
Patching closes the hole but doesn’t remove an implant that’s already there. Run these three checks before anything else:
# Look for the Rust backdoor masquerading as system processes
ps -eo user,pid,ppid,stat,comm,args | grep -iE '[k]worker|[f]c-cache|[c]hronyd'
# Check for cron persistence entries
crontab -l 2>/dev/null | grep -Ei 'gvfsd|fc-cache|chronyd|\.chrony-|\.cache/fontconfig'
# Find PHP files dropped in media directory
find pub/media -type f -name '*.php' -printIf any of these return results you didn’t put there, treat the server as compromised. Preserve evidence first — copy process lists, cron files, and log files — before removing anything. Also check for anomalous UDP traffic to port 123 from your application host, which shouldn’t be generating NTP packets at all.
Patch Now, Then Rotate Everything
Apply VULN-39341 from Adobe’s official security bulletin APSB26-146:
curl -fSLO https://repo.magento.com/patch/VULN-39341-composer-patches.zip
unzip VULN-39341-composer-patches.zip
patch -p1 < VULN-39341_Hotfix_COMPOSER.patch
bin/magento cache:flushFor Adobe Commerce Cloud, place the patch in your m2-hotfixes/ directory and deploy via Git. Verify it applied: vendor/bin/magento-patches -n status | grep 39341.
If you were exposed between September 4 and September 7, credential rotation is not optional. Admin passwords, database credentials, payment gateway API keys, OAuth tokens, SSH deployment keys, and SMTP credentials — rotated at the source, not just re-encrypted. Rotating the Magento encryption key alone doesn’t invalidate anything an attacker already read.
If you can’t patch immediately, block the GraphQL endpoint as a temporary measure. Nginx: location ^~ /graphql { return 403; }. Cloudflare users can add a WAF rule blocking http.request.uri.path eq "/graphql". See Swiss Up Labs’ cleanup guide for full incident response steps including database audits and Redis session invalidation.
The Deeper Problem
Template engines don’t get treated as security boundaries. They should be. Magento’s templating system exists to give merchants flexibility in transactional email design — a reasonable product decision. But that flexibility means user-influenced data flows into a processing engine that can execute code. StyleSmuggler exploited exactly that gap. Any system where externally-influenced input reaches a template renderer deserves the same scrutiny you’d give a SQL query or a shell command. If your application generates emails from templates and you haven’t reviewed what inputs reach that rendering path, this is a good week to do it.
