Critical E-Commerce Alert: Adobe Patches Magento Zero-Day (CVE-2026-75650) Exploited to Deploy Rust Backdoor and Web Shells
Executive Summary
Adobe has officially released emergency out-of-band security updates for Adobe Commerce and Magento Open Source to address an actively exploited critical zero-day vulnerability tracked as CVE-2026-75650 (The Hacker News). Discovered and dubbed StyleSmuggler by e-commerce security firm Sansec, the vulnerability allows unauthenticated remote attackers to execute arbitrary code on an online storefront's server without requiring valid credentials. In real-world intrusions, threat actors have exploited the flaw to deploy a compiled Rust-based Linux backdoor and persistent PHP web shells, establishing durable control over targeted e-commerce databases and payment checkout workflows.
Deep-Dive Technical Analysis
StyleSmuggler: From Template Injection to Unauthenticated RCE
Adobe Commerce and Magento Open Source rely heavily on a modular XML-based layout engine and dependency-injection container to dynamically render frontend catalog pages, checkout carts, and customer account portals. Technical analysis reveals:
1. Vulnerability Mechanism: CVE-2026-75650 manifests as an improper input validation and template injection defect within Magento's layout-processing pipeline. Unauthenticated remote attackers submit crafted HTTP POST requests containing malformed style directives and layout parameters to public-facing storefront endpoints.
2. Template Engine Abuse: The layout processor inadvertently evaluates attacker-supplied directives during runtime template cache compilation. This allows the attacker to bypass web application firewall (WAF) regex inspection and achieve arbitrary PHP code execution within the context of the web server user (e.g., www-data).
3. Dual-Payload Weaponization: In observed active campaigns, threat actors deployed two distinct persistence mechanisms:
* Rust-Based Linux Backdoor: A high-performance compiled Rust executable dropped onto the host filesystem that initializes background reverse TCP connections to external command-and-control (C2) servers, awaiting interactive shell commands while evading standard PHP file integrity monitors.
* PHP Dropper & Web Shell: A secondary obfuscated PHP dropper that writes persistent web shells capable of dumping database contents, altering configuration tables, and modifying core checkout scripts.
4. Rapid Time-to-Compromise: Telemetry from Dutch development platform Disrex confirmed that an enterprise Magento server was fully compromised within 50 minutes of the initial in-the-wild exploitation on September 4, 2026. Threat intelligence from Previdian identified scanning and exploit probes originating from IP addresses in China and Romania.
Industry Impact & Supply Chain Blast Radius
E-commerce platforms remain premier targets for cybercrime cartels due to the direct monetization of payment data:
* Affected Software Releases: The vulnerability impacts virtually all supported production branches, including Adobe Commerce 2.4.9-2026-aug and earlier, 2.4.8, 2.4.7, 2.4.6, 2.4.5, 2.4.4; Adobe Commerce B2B 1.5.3, 1.5.2, 1.4.2, 1.3.4, 1.3.3; and Magento Open Source 2.4.9, 2.4.8, 2.4.7, and 2.4.6.
* Magecart & Digital Skimming Exposure: Once root or web server control is achieved, adversaries modify JavaScript checkout scripts (such as checkout.js) to silently harvest customer payment card numbers, CVVs, expiration dates, and billing addresses in real time.
Actionable Recommendations & Mitigations
1. Apply Adobe Security Updates Immediately: Upgrade all Adobe Commerce and Magento Open Source deployments to the patched release builds specified in Adobe's official security bulletin without delay.
2. Conduct Thorough Filesystem & Backdoor Scans: Inspect webroots and system directories (particularly /tmp, /var/tmp, and pub/media/) for unrecognized compiled ELF binaries (Rust backdoors) and newly modified .php or .phtml files.
3. Audit Administrator Accounts & API Integrations: Review the Magento database table admin_user for newly created or unauthorized administrative profiles, and verify that integration API bearer tokens have not been created or exfiltrated.
4. Rotate Database & Payment Gateway Secrets: Because root and database access may have been achieved prior to patching, immediately rotate database credentials (app/etc/env.php), encryption keys, and third-party payment gateway API secrets.
________________
Sources & References: The Hacker News.