Loading story…
Attackers exploited CVE-2026-75650 (StyleSmuggler), a critical template-engine vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, before Adobe released hotfix VULN-39341. Rated CVSS 10.0, the flaw enables unauthenticated remote code execution without user interaction by poisoning application data with PHP code that executes when Magento renders its “Payment Transaction Failed Reminder” email template. Sansec documented exploitation beginning September 4, three days before the hotfix release; CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on September 8.
CrowdSec recorded 2,760 matching exploitation-attempt signals during September 9–13 and counted 500 unique source IP addresses by September 14, although those signals do not establish successful compromise. Reported compromises involved persistent Rust backdoors and PHP web shells, so previously exposed stores should apply Adobe’s hotfix, investigate for persistence, and rotate credentials rather than assume patching removes an existing intrusion. Rotating residential sources weaken IP-blocklist defenses, while request-level virtual patching offers incomplete protection and cannot replace the vendor fix.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
By September 14, CrowdSec's Live Exploit Tracker had counted 500 unique source IP addresses; its telemetry recorded 2,760 matching signals during September 9–13. These signals represent exploitation attempts, not confirmed compromises, and IP counts do not establish the number of attackers.
CrowdSec recorded 1,303 matching signals from 193 distinct sources, the peak of its September 9–13 observation period. Its Live Exploit Tracker classified the vulnerability as being in Rapid Escalation from September 11.
CrowdSec released its detection rule and AppSec virtual patch on the day it first observed a matching exploitation attempt. The virtual patch checks request URLs and Store headers for PHP opening tags but does not inspect request bodies.
A public GitHub repository was created claiming to reproduce the full unauthenticated exploit chain in a laboratory environment. CrowdSec identified no official proof of concept and did not establish that the repository's claim had been validated.
CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, recognizing exploitation in the wild. The agency set September 11 as the federal remediation deadline.
Adobe released hotfix VULN-39341 through repo.magento.com under advisory APSB26-146, and vulnerability information was published the same day. CVE-2026-75650 carries a reported CVSS score of 10.0 and affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source; unsupported product lines received no official patch.
Sansec observed exploitation of CVE-2026-75650 late on September 4, three days before Adobe released a fix. Attackers poisoned Magento application data with PHP code and triggered execution through the “Payment Transaction Failed Reminder” email template.
Sansec identified a second actor placing a PHP web shell in Magento's product image cache, establishing another reported compromise pattern associated with StyleSmuggler exploitation.
Sansec found a Rust backdoor disguised as system processes that communicated with its operators using traffic resembling Network Time Protocol packets. The reported backdoors used cron jobs for persistence and could survive application code updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are actively exploiting **StyleSmuggler**, an unpatched unauthenticated remote-code-execution chain in Magento Open Source that may also affect Adobe Commerce. The attack injects malicious PHP through Magento template style properties, poisoning a log or report file before triggering its execution through the Payment Transaction Failed Reminder email-rendering path. Sansec reproduced the chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 systems, while a confirmed victim ran fully patched 2.4.6-p15. Following execution, attackers install a persistent Linux implant using cron and masquerade processes as `kworker`. Reported indicators include download host `247.cdnflare.xyz`, WebSocket-over-TLS C2 endpoint `99.84.67.186:443`, and artifacts under `~/.local/share/.gvfsd/` and `/tmp/.kw_*`. No vendor CVE, patch, or formal workaround was available at the time of reporting; organizations should investigate Magento hosts for compromise, apply layered web controls, consider disabling GraphQL where feasible, and rotate session and application credentials on potentially affected deployments.
Sep 12, 2026
Adobe released fixes for **Blockstrap (CVE-2026-103849)**, a CVSS 10.0 template-engine injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP on affected Magento and Adobe Commerce servers. The fixes were published on October 13 in security bulletin **APSB26-153**. Sansec reproduced four code-execution routes within 24 hours, highlighting the potential for rapid exploit development. As of October 15, Sansec had not observed exploitation on live stores, but warned that attackers could develop exploits quickly. Merchants should urgently apply the October security release or Adobe’s isolated patch while retaining the separate September **StyleSmuggler** hotfix. Both fixes are required; the Blockstrap remediation does not replace the earlier hotfix.
Oct 16, 2026
Adobe issued security updates for multiple vulnerabilities in **Adobe Commerce**, Adobe Commerce B2B, and Magento Open Source, including `CVE-2026-71362`, which open-source reporting indicates is being actively exploited in the wild. The broader advisory also covers Adobe Campaign Classic, ColdFusion, Content Credentials tools and SDKs, and Lightroom Classic. The Commerce flaws are remotely exploitable and may enable arbitrary code execution, malicious script injection into web forms, disclosure of sensitive information, security-control bypasses, privileged access to restricted files, and temporary denial of service. NCSC Netherlands, Guyana CIRT, and bjCSIRT urged administrators to apply Adobe's updates immediately; NCSC reported no known public proof-of-concept or exploit code for the vulnerabilities it described.
Sep 12, 2026