Adobe Fixes Critical Magento Zero-Day Used for Rust Backdoor

Introduction

Adobe has moved quickly to address a critical security flaw affecting its Commerce and Magento Open Source platforms. The vulnerability, identified as CVE-2026-75650 and given the nickname StyleSmuggler by researchers at Sansec, was being actively exploited in the wild starting early September 2026. Attackers used the flaw to install a Rust based backdoor and a PHP web shell, giving them persistent control over compromised stores. This article explains what the vulnerability is, how it was used, and what steps organizations should take now.

Understanding the StyleSmuggler Zero-Day

The flaw resides in a component that processes custom styling inputs within the Magento frontend. By sending a specially crafted request, an unauthenticated attacker could trigger a memory corruption condition that leads to arbitrary code execution. The vulnerability carries a CVSS score of 10.0, reflecting its maximum severity because it requires no privileges and can be exploited remotely. Sansec first observed exploitation attempts on September 4 2026, noting a rapid increase in traffic to certain admin endpoints that matched the pattern of the exploit.

Because the issue is present in both the licensed Adobe Commerce edition and the free Magento Open Source version, a wide range of merchants were potentially exposed. The exploit chain allowed attackers to first gain execution, then drop a Rust compiled payload that established a covert communication channel, followed by a PHP web shell that facilitated further commands and data exfiltration.

Technical Details: Rust Backdoor and PHP Web Shell

The Rust backdoor is a compact binary designed to evade traditional signature based detection. Once executed, it opens an encrypted tunnel to a command and control server, allowing the attacker to issue commands, upload additional tools, and harvest sensitive data such as customer information and payment details. The use of Rust provides advantages in terms of execution speed and difficulty of reverse engineering for many security analysts.

Following the initial compromise, the attackers deployed a PHP web shell placed in a publicly accessible directory of the Magento installation. This shell accepts HTTP POST requests containing encoded commands, which it then executes on the server with the privileges of the web server process. The web shell was obfuscated using base64 encoding and variable renaming to hinder detection by standard file integrity monitoring tools.

Analysis of the exploit payloads revealed that the attackers leveraged a known deserialization weakness in the styling parser, chaining it with a heap spraying technique to gain control of instruction pointers. The combination of low level memory manipulation and high level scripting gave the attackers a flexible and persistent foothold.

Impact on Adobe Commerce and Magento Open Source

Stores that remained unpatched faced risks including:

• Unauthorized access to admin panels and customer databases
• Insertion of malicious JavaScript that could skim payment card data
• Potential ransomware deployment through the established backdoor channel
• Reputational damage and possible regulatory penalties under data protection laws

Adobe’s security advisory emphasized that the patches not only fix the immediate code execution path but also harden the styling input validation to prevent similar abuse vectors. Organizations are urged to apply the updates immediately and to review logs for signs of compromise dating back to early September.

Best Practices for Mitigation and Recovery

To secure Magento environments after applying the Adobe patches, administrators should follow these steps:

• Apply the latest security patches for Adobe Commerce version 2.4.7-p2 and Magento Open Source 2.4.7-p2 without delay.
• Reset all admin passwords and review privileged account activity for any anomalies.
• Conduct a thorough file integrity scan to detect any unauthorized web shells or suspicious binaries.
• Enable web application firewall rules that block known exploit patterns targeting the styling input endpoint.
• Implement multi factor authentication for admin access to reduce the risk of credential theft.
• Monitor outbound traffic for unexpected connections to unfamiliar IP addresses, which may indicate command and control communication.
• Consider engaging a third party forensic team if any signs of compromise are discovered, to ensure complete eradication of attacker artifacts.

Maintaining an up to date inventory of all extensions and custom code is also vital, as third party modules can sometimes reintroduce vulnerable functions even after core patches are applied.

Conclusion

The rapid response by Adobe to the StyleSmuggler zero‑day underscores the importance of vigilant patch management in the ecommerce sector. While the immediate threat has been mitigated through the released updates, the incident serves as a reminder that attackers continuously evolve their tooling, employing languages like Rust to stealthily maintain access. Organizations that prioritize continuous monitoring, timely updates, and proactive threat hunting will be better positioned to defend against similar campaigns. Grivyonx Cloud supports businesses with AI driven anomaly detection and automated compliance workflows that help identify suspicious behavior before it leads to a breach, allowing teams to focus on growth rather than constant firefighting.