[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyQfExGtCZcrARo6Oidv3YjeAwKDLgbVezfEWkWtcNBA":3},{"article":4,"iocs":56,"watch_terms":65,"solutions":66,"lesson":126},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"22d8033f-556b-4258-a148-07fb1cfa2003","Adobe Commerce Zero-Day Exploited to Backdoor Online Stores","adobe-commerce-zero-day-exploited-to-backdoor-online-stores-be4e97","The StyleSmuggler zero-day allows attackers to execute code and deploy a stealthy backdoor on Adobe Commerce and Magento stores. The post Adobe Commerce Zero-Day Exploited to Backdoor Online Stores appeared first on SecurityWeek.","Threat actors are actively exploiting StyleSmuggler, a zero-day vulnerability in Adobe Commerce and Magento 2.4.7–2.4.9, to inject PHP code and deploy a Rust-based backdoor on online stores. The attack leverages Magento's template system and payment failure email mechanism to execute remote code without user interaction. The backdoor communicates with C&C servers over disguised NTP replies and has been observed in active campaigns since September 4, 2026.","StyleSmuggler zero-day in Adobe Commerce and Magento enables RCE and backdoor deployment on e-commerce stores.","https:\u002F\u002Fwww.securityweek.com\u002Fadobe-commerce-zero-day-exploited-to-backdoor-online-stores\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F11\u002FNPM-code-software-development.jpeg","2026-09-07T11:58:37+00:00","2026-09-07T12:00:08.055828+00:00",9,[17,20,22,25,27],{"name":18,"type":19},"Adobe Commerce","product",{"name":21,"type":19},"Magento",{"name":23,"type":24},"Adobe","vendor",{"name":26,"type":24},"Sansec",{"name":28,"type":29},"StyleSmuggler","campaign","574f766a-fb3f-487c-8d2c-0720ae75471b",{"id":30,"icon":32,"name":33,"slug":34},null,"Zero-day","zero-day",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":32,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,59,62],{"type":50,"value":28,"context":58},"Zero-day RCE vulnerability in Adobe Commerce\u002FMagento used to deploy backdoors",{"type":50,"value":60,"context":61},"[kworker\u002Fu:8:0]","First variant of StyleSmuggler backdoor disguise, deployed from September 4",{"type":50,"value":63,"context":64},"fc-cache","Second variant of StyleSmuggler backdoor disguise, emerged September 6",[23,26,18],{"controls":67,"vendors":125},[68,96],{"slug":69,"name":70,"problem":71,"products":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":69,"product_name":93,"url":94,"description":95},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":97,"name":98,"problem":99,"products":100},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[],{"slug":127,"title":128,"body":129,"framework_refs":130,"framework_notes":145},"adobe-commerce-zero-day-exploited-to-backdoor-e-commerce-stores","Adobe Commerce Zero-Day Exploited to Backdoor E-Commerce Stores","Threat actors are actively exploiting a zero-day vulnerability dubbed StyleSmuggler in Adobe Commerce and Magento 2.4.7–2.4.9, abusing the platform's template system and payment failure email mechanism to inject PHP code and deploy a sophisticated Rust-based backdoor — all without requiring user interaction. The root cause is the absence of an available patch for a known attack surface in widely deployed e-commerce software, leaving merchants exposed during the critical window between discovery and remediation. What makes this particularly dangerous is the backdoor's covert command-and-control communication disguised as NTP traffic, making detection significantly harder with standard network monitoring tools. Online stores are high-value targets due to the payment card and personal data they process, meaning a successful compromise can lead to large-scale financial fraud, regulatory penalties, and severe reputational damage.",[131,132,133,134,135,136,137,138,139,140,141,142,143,144],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","CIS Control 10: Malware Defenses","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-3: Malicious Code Protection","NIST SI-7: Software, Firmware, and Information Integrity","NIST CA-7: Continuous Monitoring","NIST SC-7: Boundary Protection","PCI DSS Requirement 6.3: Security Vulnerabilities are Identified and Addressed","PCI DSS Requirement 10.7: Failures of Critical Security Controls are Detected and Reported","GDPR Article 32: Security of Processing","OWASP Top 10: A03 Injection \u002F A08 Software and Data Integrity Failures","ITIL: Problem Management – Root Cause Analysis and Known Error Control",{}]