Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

Adobe released emergency patches Monday for a maximum-severity zero-day vulnerability in Adobe Commerce and Magento Open Source that attackers actively exploit to install backdoors and web shells on compromised systems.

CVE-2026-75650 carries a perfect CVSS severity score of 10.0, the highest possible rating. Researchers at Sansec discovered active exploitation beginning September 4, 2026, and assigned the threat the codename StyleSmuggler. The vulnerability affects both Adobe's commercial Commerce platform and the open-source Magento variant, creating exposure across thousands of e-commerce websites globally.

Attackers weaponize this flaw to deploy two distinct malware payloads. The first is a Rust-based backdoor that provides persistent remote access to compromised servers. The second is a PHP web shell that enables attackers to execute arbitrary code and maintain long-term control over the infrastructure. Combined, these tools give threat actors the ability to steal payment data, customer information, and inject malicious code into the checkout process.

E-commerce merchants running affected Magento versions face immediate risk. Attackers can exploit the vulnerability without authentication, meaning no valid account or special privileges are necessary for compromise. The perfect CVSS score reflects this severity. Once a backdoor establishes itself, attackers can harvest credit card data during transactions, redirect customer payments to attacker-controlled accounts, or plant formjacking scripts that capture credentials during login.

The timeline matters here. Sansec detected active exploitation starting September 4. Adobe's patch release on Monday means a window existed where threat actors actively compromised systems while public patches remained unavailable. Organizations should assume some Magento installations already contain backdoors.

This vulnerability follows a pattern seen in Magento attacks over the past several years. The Magento platform ranks among the most targeted e-commerce systems, not because of inherent code quality but because of the high-value targets it protects. A single compromised store can yield months of stolen payment card data, and the ecosystem remains fragmented with many merchants running outdated versions.

For Adobe Commerce subscribers and Magento Open Source users, immediate action is required. Apply the security patch directly after testing in a non-production environment. For those unable to patch immediately, network segmentation becomes essential. Isolate Magento instances from other systems. Monitor outbound traffic for command-and-control connections. Review web server logs for suspicious PHP execution patterns or unusual file uploads.

Payment card data is the primary target here. Merchants processing payments on compromised systems should notify their acquiring banks and consider a payment card industry investigation even if no fraud has been confirmed. The backdoor nature of these malware samples means attackers maintain access long after initial compromise, sometimes for months before detection.

The Rust backdoor component indicates sophistication in the attack chain. Rather than rely solely on PHP for persistence, attackers use a compiled, harder-to-detect binary. This suggests the threat actors behind StyleSmuggler operate with resources and skill typical of organized cybercriminal groups focused on payment theft.

Magento administrators should check deployment logs immediately for suspicious file uploads or modifications starting around September 4. Sansec's research should provide indicators of compromise to help identify whether specific installations were targeted.