CVE-2026-75650: Adobe Commerce / Magento 'StyleSmuggler' Zero-Day Exploited in the Wild — Detection and Remediation Guide

---
title: Web Server or PHP Process Spawning Shell on Magento/Adobe Commerce Host
id: 3f9c2a71-8e4d-4b6a-9f12-7c5e1a3d8b24
status: experimental
description: Detects the web server or PHP-FPM worker process spawning an interactive shell or command interpreter, consistent with post-exploitation of CVE-2026-75650 (StyleSmuggler) webshell activity on Magento/Adobe Commerce servers.
references:
  - https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-magento-zero-day-exploited-to-backdoor-servers/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
  - attack.execution
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/php'
      - '/nginx'
      - '/apache2'
      - '/httpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; legitimate Magento cron and CLI tasks run under the application user, not as children of the web worker
level: high
---
title: PHP Webshell Written to Magento Web-Accessible Directory
id: 8b1d4e62-5c7a-4f39-a2e8-6d9b3f1c7a45
status: experimental
description: Detects creation or modification of PHP files in web-accessible Magento/Adobe Commerce directories (pub, pub/media, pub/static) where code should not be dynamically written, a common indicator of backdoor deployment following CVE-2026-75650 exploitation.
references:
  - https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-magento-zero-day-exploited-to-backdoor-servers/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/pub/media/'
      - '/pub/static/'
      - '/var/report/'
      - '/var/log/'
      - '/generated/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  condition: selection_path and selection_ext
falsepositives:
  - Magento static content deployment during legitimate build/deploy pipelines (scope to change windows)
level: high
---
title: Suspicious Outbound Connection from PHP-FPM Worker
id: 5e7a9c34-2b8f-4d16-b3a5-9c1e4f7a2d68
status: experimental
description: Detects PHP-FPM or web server processes initiating outbound network connections to uncommon external hosts, consistent with webshell command-and-control or payload retrieval after Magento/Adobe Commerce compromise via CVE-2026-75650.
references:
  - https://www.bleepingcomputer.com/news/security/adobe-fixes-critical-magento-zero-day-exploited-to-backdoor-servers/
  - https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/php-fpm'
      - '/php'
      - '/nginx'
      - '/apache2'
    Initiated: 'true'
  filter_known:
    DestinationIp|startswith:
      - '10.'
      - '172.16.'
      - '192.168.'
  condition: selection and not filter_known
falsepositives:
  - Outbound API calls from Magento modules (payment gateways, shipping APIs) — baseline destination domains and alert on new ones
level: medium

// Hunt 1: Suspicious requests to Magento application paths and probes for webshell artifacts
let Lookback = 14d;
CommonSecurityLog
| where TimeGenerated > ago(Lookback)
| where DeviceProduct has_any ("nginx", "apache", "varnish") or ApplicationProtocol == "http"
| where RequestURL has_any ("/pub/media/", "/pub/static/", "/var/", "/downloader/", "/app/etc/")
    and RequestURL has_any (".php", ".phtml", "cmd=", "eval", "base64", "shell")
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    Targets = make_set(DestinationHostName, 20), URIs = make_set(RequestURL, 20)
  by SourceIP, RequestMethod
| order by RequestCount desc
;
// Hunt 2: Shells or downloaders spawned as the web/PHP user (Syslog from Linux hosts)
Syslog
| where TimeGenerated > ago(Lookback)
| where Facility == "auth" or ProcessName has_any ("php", "php-fpm", "nginx", "apache2")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "curl ", "wget ", "nc -", "python -c", "base64 -d")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

-- Hunt for webshell indicators on Magento/Adobe Commerce hosts (CVE-2026-75650)
-- 1) Recently modified PHP files in directories that should not contain dynamic code
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
    '/var/www/**/pub/media/**/*.php',
    '/var/www/**/pub/static/**/*.php',
    '/var/www/**/var/**/*.php',
    '/srv/**/pub/media/**/*.php'
])
WHERE Mtime > (now() - 1209600)
ORDER BY Mtime DESC

-- 2) PHP-FPM / web workers with shell or downloader children
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)php|nginx|apache|httpd'
   OR CommandLine =~ '(?i)/bin/(sh|bash)|curl |wget |nc -|base64 -d'

#!/bin/bash
# CVE-2026-75650 (StyleSmuggler) post-patch integrity verification
# Run on each Magento/Adobe Commerce host as root or the application user

DOCROOT="/var/www/html"   # Adjust to your Magento document root
DAYS=30

echo "[1] PHP files modified in the last $DAYS days under web-accessible dirs:"
find "$DOCROOT/pub" "$DOCROOT/var" "$DOCROOT/generated" \
    -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) \
    -mtime -$DAYS -printf "%TY-%Tm-%Td %TH:%TM  %u  %p\n" 2>/dev/null | sort

echo ""
echo "[2] Obfuscation signatures common in webshells:"
grep -rln --include="*.php" -E "eval\s*\(|base64_decode\s*\(|gzinflate\s*\(|shell_exec\s*\(|passthru\s*\(|assert\s*\(|preg_replace\s*\(.*/e" \
    "$DOCROOT/pub" "$DOCROOT/var" 2>/dev/null

echo ""
echo "[3] Suspicious child processes of web/PHP daemons:"
for pid in $(pgrep -f 'php-fpm|nginx|apache2|httpd'); do
    children=$(ps --ppid "$pid" -o pid,comm,args --no-headers 2>/dev/null | grep -Ei 'sh|bash|curl|wget|nc|python|perl')
    [ -n "$children" ] && echo "PARENT $pid -> $children"
done

echo ""
echo "[4] New local users or SSH keys (persistence check):"
awk -F: '$3 >= 1000 && $3 < 65534 {print $1, $3, $6}' /etc/passwd
find /home /root -name "authorized_keys" -mtime -$DAYS 2>/dev/null

echo ""
echo "[5] Cron persistence planted by web user:"
crontab -l -u www-data 2>/dev/null; crontab -l -u nginx 2>/dev/null; crontab -l -u apache 2>/dev/null
ls -la /etc/cron.d/ 2>/dev/null | grep -v "^total"

echo ""
echo "[6] Database credentials in env.php — rotate if any hit above fires:"
grep -E "'(password|username|dbname)'" "$DOCROOT/app/etc/env.php" 2>/dev/null | sed 's/=>.*/=> [REDACTED-CHECK]/'