Adobe fixes critical Magento zero-day exploited to backdoor servers
Adobe fixes critical Magento zero-day exploited to backdoor servers.
Adobe has released an emergency fix for CVE-2026-75650, a critical zero-day vulnerability in Magento and Adobe Commerce known as StyleSmuggler. This flaw has been actively exploited since at least September 4th to plant backdoors on vulnerable servers, with attackers using disguised NTP servers for command and control. A second attacker was observed deploying a PHP web shell that exfiltrates data to an oast.site subdomain.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Adobe?
Get an email when a new story names Adobe, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAdobe's Magento and Adobe Commerce platforms were actively exploited via CVE-2026-75650 (StyleSmuggler) before a patch was available, meaning organizations had no window to remediate through standard patching cycles. Attackers leveraged the flaw to implant persistent backdoors and PHP web shells, enabling long-term unauthorized access and data exfiltration. The use of disguised NTP servers for command-and-control traffic highlights how attackers blend malicious activity into legitimate-looking protocols to evade detection. This incident underscores the existential risk of internet-facing e-commerce platforms that handle sensitive payment and customer data. Without robust monitoring and rapid response capabilities, zero-day exploitation can go undetected for weeks or months.
What helps against this
How we list vendors- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-75650
- domain — oast.site