[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fyisYI59Hf89z1_NiiM9tpLzcpTtsggCWa5V6UwdjL1s":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":54},"dd2e2d37-e17e-4f89-97b5-e409462be7fe","adobe-commerce-zero-day-exploited-to-install-psk-agent-rat-on-e-commerce-servers","d76a2771-a2cb-46e7-9cb9-a610912813a5","Adobe Commerce Zero-Day Exploited to Install PSK Agent RAT on E-Commerce Servers","Attackers leveraged CVE-2026-75650 (StyleSmuggler), a critical zero-day in Adobe Commerce and Magento, to deploy the PSK Agent remote access tool before any patch was available, highlighting the acute danger of unmitigated vulnerabilities in internet-facing e-commerce platforms. The RAT grants full remote control, command execution, and traffic proxying, meaning compromised stores risk customer data theft, payment fraud, and prolonged attacker persistence. A 0% VirusTotal detection rate at time of analysis underscores how traditional signature-based defenses fail against novel malware, making layered detection strategies essential. The involvement of multiple threat groups signals that zero-day intelligence was shared or independently discovered rapidly, compressing the window between disclosure and mass exploitation to near zero.","**Immediate actions:**\n- Apply Adobe's emergency patch or workaround for CVE-2026-75650 as soon as it is released, treating e-commerce platforms as critical-priority assets.\n- Deploy Web Application Firewall (WAF) virtual patching rules targeting the StyleSmuggler exploit pattern to block active exploitation attempts while a vendor patch is pending.\n- Isolate compromised Adobe Commerce\u002FMagento servers from internal networks and payment systems to contain lateral movement by PSK Agent.\n\n**Detection measures:**\n- Enable behavioral endpoint detection (EDR\u002FXDR) on web servers to flag anomalous process spawning, outbound proxy traffic, and persistence mechanisms indicative of RAT activity.\n- Conduct threat-hunting exercises searching for PSK Agent indicators of compromise (IOCs) across all e-commerce infrastructure, including file hashes and network beaconing patterns.\n- Increase log verbosity on web server access logs and forward them to a SIEM with alerting on unusual admin-panel requests or unexpected file writes.\n\n**Long-term improvements:**\n- Establish a formal zero-day response playbook that defines escalation, compensating controls, and communication timelines for critical vulnerabilities affecting revenue-generating systems.\n- Implement continuous attack surface management scanning to maintain real-time visibility into the vulnerability posture of all internet-facing assets.\n- Enforce strict network segmentation so that e-commerce web servers have no direct access to internal databases, payment processing systems, or corporate networks.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","PCI DSS Requirement 6","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"MITRE ATT&CK T1566: Phishing":22,"NIST SP 800-53 SI-2: Flaw Remediation":23,"OWASP A06:2021 Vulnerable and Outdated Components":24,"CIS Control 7: Continuous Vulnerability Management":25,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":26},"NIS2 requires essential and important entities to implement measures for incident handling and vulnerability management; operators of significant e-commerce platforms must have rapid-response procedures for zero-day exploitation, as mandated by this article.","PCI DSS Requirement 6 mandates that merchants develop and maintain secure systems, including prompt patching of known vulnerabilities on systems that store, process, or transmit cardholder data — directly applicable to Magento\u002FAdobe Commerce deployments.","While the initial vector here is web exploitation rather than phishing, PSK Agent's persistence and remote-access capabilities map to multiple ATT&CK techniques; using the ATT&CK framework to model adversary behaviour would have guided detection engineering for RAT persistence and C2 traffic.","SI-2 requires organisations to identify, report, and remediate information system flaws within defined timeframes; a mature flaw remediation process would have prioritised emergency mitigations for this zero-day affecting internet-facing commerce servers.","Adobe Commerce is an externally managed component; OWASP A06 directly calls for continuous monitoring of component vulnerabilities and rapid upgrading, which would have prompted immediate action upon StyleSmuggler's disclosure.","Continuous vulnerability scanning and a defined remediation SLA for critical flaws would have ensured rapid compensating controls were applied the moment CVE-2026-75650 was disclosed, shrinking the exploitation window.","This control mandates timely identification of technical vulnerabilities and the taking of appropriate countermeasures, including virtual patching and compensating controls when vendor patches are unavailable for zero-days.","published","2026-11-03T11:21:29.164633+00:00","2026-11-03T11:21:29.134+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fcybersecuritynews.com\u002Fadobe-commerce-zero-day\u002F","hackers-exploit-adobe-commerce-zero-day-to-deploy-psk-agent-rat-and-remotely-con-24cb93","Hackers Exploit Adobe Commerce Zero-Day to Deploy PSK Agent RAT and Remotely Control Servers",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[48],{"id":49,"date":50,"edition":51,"title":52,"audio_url":53},"21ac5668-2098-4170-af6b-77058a810e7e","2026-11-03","afternoon","ThreatNoir Afternoon Brief — November 3","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-11-03\u002Fthreatnoir-afternoon-brief-2026-11-03.mp3",[55,58],{"slug":44,"name":56,"problem":57},"Automated patch management","Known holes get closed in days, not months.",{"slug":59,"name":60,"problem":61},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]