Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

Summary

Adobe has released patches for a critical zero-day vulnerability (CVE-2026-75650) in Adobe Commerce and Magento Open Source, codenamed StyleSmuggler. This flaw allows for arbitrary code execution and has been actively exploited to deploy Rust backdoors and PHP web shells.

Key Takeaways

1. Adobe released security patches for a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has been actively exploited.
2. The vulnerability, CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec and zero-day exploitation began on September 4, 2026.
3. Exploitation involves PHP code injection through Magento's template system to trigger arbitrary code execution, leading to the deployment of Rust backdoors and PHP web shells.

Statement Breakdown

• Claimed Facts: 70% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 15% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The article presents factual information about a security vulnerability and its patching. It cites specific CVE numbers, CVSS scores, and affected software versions. The information is attributed to reputable security firms and Adobe.

Bias assessment: Technical Reporting. The article focuses on technical details of a cybersecurity incident. It reports on a vulnerability, its exploitation, and the vendor's response without adopting a particular political or social stance.

Note: This article details a critical security vulnerability. Ensure your Adobe Commerce and Magento Open Source systems are updated to the latest patched versions to mitigate risks.

Credibility flag: Technical Security Alert

Claimed Facts (7)

• This is a factual statement about Adobe's action and the status of the vulnerability.
• This provides specific identifiers and a timeline for the vulnerability.
• This is a direct quote from Adobe confirming the vulnerability and its exploitation.
• This describes the technical mechanism of the vulnerability.
• This provides a direct link to the patch, a verifiable piece of information.
• This states a fact about the exploitation and the type of malware deployed.
• This describes another method of exploitation and its outcome.

Opinions (1)

• This is an expert's interpretation of how the vulnerability functions.

Claims (1)

• The phrase 'is said to have been compromised' introduces a degree of uncertainty or hearsay, making it less of a direct claimed fact.

Key Sources

• Adobe — Software Vendor
• Sansec — E-commerce Security Company
• Disrex — E-commerce Development Platform
• Ravie Lakshmanan — Author
• The Hacker News — Cybersecurity News Outlet