[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fAVM7_IbD1YG45G3TwzIXFzEf_wW47rueXTDaetwncRA":3},{"article":4,"iocs":51,"watch_terms":60,"solutions":61,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"47172baf-6a24-4479-8754-f0cfce35a908","Adobe fixes critical Magento zero-day exploited to backdoor servers","adobe-fixes-critical-magento-zero-day-exploited-to-backdoor-servers-7cfb42","Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that impacts multiple versions of Magento and Adobe Commerce. [...]","Adobe has released an emergency fix for CVE-2026-75650, a critical zero-day vulnerability in Magento and Adobe Commerce known as StyleSmuggler. This flaw has been actively exploited since at least September 4th to plant backdoors on vulnerable servers, with attackers using disguised NTP servers for command and control. A second attacker was observed deploying a PHP web shell that exfiltrates data to an oast.site subdomain.","Adobe fixes critical Magento zero-day exploited to backdoor servers.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fadobe-fixes-critical-magento-zero-day-exploited-to-backdoor-servers\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F04\u002F13\u002FAdobe.jpg","2026-09-08T13:34:47+00:00","2026-09-08T14:00:10.161667+00:00",9,[17,20,22,25],{"name":18,"type":19},"Magento","product",{"name":21,"type":19},"Adobe Commerce",{"name":23,"type":24},"Adobe","vendor",{"name":26,"type":27},"NTP","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56],{"type":53,"value":54,"context":55},"cve","CVE-2026-75650","Critical zero-day vulnerability in Magento and Adobe Commerce.",{"type":57,"value":58,"context":59},"domain","oast.site","Subdomain used for data exfiltration by a PHP web shell.",[23,18,21],{"controls":62,"vendors":149},[63,91,120],{"slug":64,"name":65,"problem":66,"products":67},"patch-management","Automated patch management","Known holes get closed in days, not months.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":64,"product_name":88,"url":89,"description":90},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":92,"name":93,"problem":94,"products":95},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":121,"name":122,"problem":123,"products":124},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"veeam","Veeam","\u002Fvendor-logos\u002Fveeam.png","veeam-data-platform","Veeam Data Platform","https:\u002F\u002Fwww.veeam.com\u002Fproducts\u002Fveeam-data-platform.html","Backup and recovery for virtual, physical, cloud and SaaS workloads, with immutable storage options.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"commvault","Commvault","\u002Fvendor-logos\u002Fcommvault.png","commvault-cloud","Commvault Cloud","https:\u002F\u002Fwww.commvault.com\u002Fplatform","Backup and recovery platform with immutable storage and recovery testing.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"rubrik","Rubrik","\u002Fvendor-logos\u002Frubrik.png","zero-trust-data-protection","Rubrik Zero Trust Data Protection","https:\u002F\u002Fwww.rubrik.com\u002Fproducts\u002Fdata-protection","Air-gapped, immutable backup for on-premises, cloud and SaaS data, with threat detection in backups and orchestrated recovery.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":168},"critical-magento-zero-day-stylesmuggler-exploited-to-plant-server-backdoors","Critical Magento Zero-Day (StyleSmuggler) Exploited to Plant Server Backdoors","Adobe's Magento and Adobe Commerce platforms were actively exploited via CVE-2026-75650 (StyleSmuggler) before a patch was available, meaning organizations had no window to remediate through standard patching cycles. Attackers leveraged the flaw to implant persistent backdoors and PHP web shells, enabling long-term unauthorized access and data exfiltration. The use of disguised NTP servers for command-and-control traffic highlights how attackers blend malicious activity into legitimate-looking protocols to evade detection. This incident underscores the existential risk of internet-facing e-commerce platforms that handle sensitive payment and customer data. Without robust monitoring and rapid response capabilities, zero-day exploitation can go undetected for weeks or months.",[155,156,157,158,159,160,161,162,163,164,165,166,167],"CIS Control 7 – Continuous Vulnerability Management","CIS Control 8 – Audit Log Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-61 Rev. 2 – Incident Response (Detection & Analysis)","NIST SP 800-40 Rev. 4 – Patch and Vulnerability Management","NIST SI-2 – Flaw Remediation","NIST SI-7 – Software, Firmware, and Information Integrity","NIST CA-7 – Continuous Monitoring","GDPR Article 32 – Security of Processing (breach risk mitigation)","PCI DSS Requirement 6.3 – Security Vulnerabilities Addressed via Patching","PCI DSS Requirement 10 – Log and Monitor All Access","ITIL – Change Management \u002F Emergency Change Procedure",{}]