CVE-2026-75650 (StyleSmuggler): Adobe Commerce & Magento Zero-Day Under Active Exploitation — Detection and Remediation Guide

On Monday, Adobe released an out-of-band security update addressing CVE-2026-75650, a maximum-severity vulnerability (CVSS 10.0) affecting Adobe Commerce and Magento Open Source. The flaw, codenamed StyleSmuggler by the researchers at Sansec who discovered it, has been under active exploitation in the wild since at least September 4, 2026 — meaning threat actors had a functioning attack chain in production weeks before a fix existed.

This is not a drill for the e-commerce sector. A CVSS 10.0 score on a platform that processes payment card data, customer PII, and order flows means one thing: unauthenticated remote code execution with no user interaction required. Observed post-exploitation activity includes deployment of PHP web shells for persistent access and a Rust-based unauthorized access mechanism — a notably modern payload choice that defeats many signature-based detections written for traditional C/PHP tooling. If you operate a storefront on Adobe Commerce or Magento Open Source, assume your exposure window started on September 4 and treat this as a patch-and-hunt event, not a patch-and-forget one.

Technical Analysis

Affected Products

• Adobe Commerce (cloud and on-premise deployments)
• Magento Open Source

Adobe's advisory classifies this as a critical update resolving the vulnerability. Operators running any unpatched version of Adobe Commerce or Magento Open Source exposed to the internet should consider themselves vulnerable. E-commerce platforms are, by design, internet-facing — there is no meaningful "internal-only" deployment story here for production storefronts.

Vulnerability Profile

Attack Chain (Defender's View)

Based on the observed exploitation activity, the attack chain breaks down as follows:

1. Initial access: The attacker sends a crafted request to the vulnerable Adobe Commerce / Magento component. A CVSS 10.0 score with active exploitation implies no authentication and no user interaction — the storefront itself is the attack surface.
2. Code execution on the web tier: Successful exploitation yields code execution in the context of the web server / PHP-FPM process (typically www-data, nginx, or apache on Linux hosts).
3. Web shell deployment: A PHP web shell is written to a web-accessible location. On Magento, historically favored drop locations include pub/media/, pub/static/, and other directories that are web-served but not integrity-monitored — precisely because media directories legitimately change constantly.
4. Persistent access mechanism: A compiled Rust binary is deployed as an unauthorized access mechanism. This is the component defenders should not overlook: removing the web shell without finding the Rust payload leaves the intruder with a live backdoor. Expect persistence attempts via cron, systemd units, or modification of Magento's cron schedule.

The use of a compiled Rust payload is a deliberate tradecraft choice: it produces a small, statically-linked ELF binary with no interpreter dependency, no source on disk for YARA/web-shell scanners to catch, and behavioral profiles that differ from classic PHP-based tooling.

Why This Matters Beyond the Web Tier

A compromised Magento host is a compromised cardholder data environment. For PCI-DSS-scoped organizations, this intrusion class triggers potential reportable-event obligations. Customer databases, order histories, and in many deployments cached payment integrations are all reachable from the web process context. Segmentation between the web tier and the database is your last line of defense — verify it now.

Detection & Response

The detections below target the observable behaviors described in this campaign: PHP web shell drops in web-accessible Magento directories, the web/PHP process spawning unexpected child processes, and execution of unsigned compiled binaries (the Rust payload) from world-writable or web-served paths.

Sigma Rules

---
title: Web Server or PHP-FPM Spawning Suspicious Shell Commands (StyleSmuggler Post-Exploitation)
id: 9c4e2a71-3b58-4f6d-a912-7e0d5c8b2f41
status: experimental
description: Detects the Magento/Adobe Commerce web process (php-fpm, nginx, apache) spawning reconnaissance or staging commands consistent with StyleSmuggler (CVE-2026-75650) web shell activity.
references:
  - https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1505.003
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/nginx'
      - '/apache2'
      - '/httpd'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/curl'
      - '/wget'
      - '/whoami'
      - '/id'
      - '/base64'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
  condition: selection_parent and selection_child
falsepositives:
  - Magento cron jobs legitimately invoking shell commands via bin/magento — tune against known cron command lines
level: high
---
title: PHP Web Shell Dropped in Magento Web-Accessible Directory
id: 2f8b1d64-5a93-4c27-bb38-1a6f9d3e7c52
status: experimental
description: Detects creation or modification of PHP files in Magento web-served media/static directories, a hallmark of StyleSmuggler (CVE-2026-75650) web shell deployment.
references:
  - https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_event
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/pub/media/'
      - '/pub/static/'
      - '/media/'
      - '/var/tmp/'
      - '/tmp/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
  condition: selection_path and selection_ext
falsepositives:
  - Legitimate deployments or theme updates writing PHP into static content paths — correlate with deployment windows and CI/CD activity
level: high
---
title: Execution of Unsigned Compiled Binary from Writable or Web-Served Path (Rust Payload)
id: 61d3e7a8-0c42-4bfa-9d15-8f2a4c6b1e93
status: experimental
description: Detects execution of compiled binaries from /tmp, /var/tmp, /dev/shm, or Magento web directories by the web service account, consistent with the Rust-based unauthorized access mechanism observed in StyleSmuggler exploitation.
references:
  - https://thehackernews.com/2026/09/adobe-patches-magento-zero-day.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/10
tags:
  - attack.execution
  - attack.persistence
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_path:
    Image|contains:
      - '/tmp/'
      - '/var/tmp/'
      - '/dev/shm/'
      - '/pub/media/'
      - '/pub/static/'
  selection_user:
    User|contains:
      - 'www-data'
      - 'nginx'
      - 'apache'
      - 'magento'
  filter_known:
    Image|endswith:
      - '/bin/magento'
  condition: selection_path and selection_user and not filter_known
falsepositives:
  - Rare; legitimate web-service execution of binaries from world-writable paths is anomalous in hardened Magento deployments
level: critical

KQL — Microsoft Sentinel / Defender

If your Magento hosts ship Syslog/auditd data into Sentinel via the Linux agent or CEF, the following hunt surfaces web-process child execution and PHP drops in media paths since the exploitation window opened on September 4, 2026.

// Hunt 1: Web/PHP process spawning shells or staging tools (post-exploitation behavior)
let ExploitWindowStart = datetime(2026-09-04);
Syslog
| where TimeGenerated >= ExploitWindowStart
| where ProcessName has_any ("php-fpm", "nginx", "apache2", "httpd", "sh", "bash")
| where SyslogMessage has_any ("whoami", "curl ", "wget ", "base64 -d", "/tmp/", "/var/tmp/", "/dev/shm", "nc -", "chmod +x")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| order by TimeGenerated asc;

// Hunt 2: PHP files written to Magento web-served directories (web shell staging)
let ExploitWindowStart = datetime(2026-09-04);
Syslog
| where TimeGenerated >= ExploitWindowStart
| where SyslogMessage has_any ("pub/media", "pub/static", "/var/www/") 
| where SyslogMessage has_any (".php", ".phtml", ".phar")
| where SyslogMessage has_any ("CREATE", "WRITE", "MOVED_TO", "open", "creat")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated asc;

// Hunt 3: Outbound connections from the web tier to rare external destinations (Rust payload C2/staging)
let ExploitWindowStart = datetime(2026-09-04);
CommonSecurityLog
| where TimeGenerated >= ExploitWindowStart
| where ApplicationProtocol has_any ("http", "https", "tcp")
| where SourceUserName has_any ("www-data", "nginx", "apache")
| summarize ConnectionCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by DeviceName, SourceIP, DestinationIP, DestinationPort, SourceUserName
| where ConnectionCount < 50
| order by FirstSeen asc

Note on Hunt 3: the low-connection-count filter isolates rare destinations. Baseline your CDN, payment gateway, and Adobe infrastructure egress first — those will dominate and should be allowlisted out of the query.

Velociraptor VQL

Use this artifact across your Magento fleet to enumerate recently created/modified PHP files in web-accessible directories and to find compiled binaries in world-writable paths — the two forensic artifacts StyleSmuggler leaves behind.

-- StyleSmuggler (CVE-2026-75650) triage: web shells in Magento media dirs + compiled payloads in writable paths
LET media_shells = SELECT 
    FullPath,
    Size,
    Mtime,
    Ctime
FROM glob(
    globs=[
        '/var/www/**/pub/media/**/*.php',
        '/var/www/**/pub/media/**/*.phtml',
        '/var/www/**/pub/static/**/*.php',
        '/srv/**/pub/media/**/*.php'
    ]
)
WHERE Mtime > parse_string_for_timestamp(string='2026-09-04')

LET writable_binaries = SELECT
    FullPath,
    Size,
    Mtime
FROM glob(globs=['/tmp/*', '/var/tmp/*', '/dev/shm/*'])
WHERE NOT IsDir
  AND Mtime > parse_string_for_timestamp(string='2026-09-04')

LET suspicious_procs = SELECT
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime
FROM pslist()
WHERE Username =~ 'www-data|nginx|apache|magento'
  AND (Exe =~ '/tmp/|/var/tmp/|/dev/shm/|pub/media|pub/static'
       OR CommandLine =~ 'base64 -d|curl .*(http)|wget .*(http)')

SELECT * FROM media_shells
UNION ALL
SELECT * FROM writable_binaries
UNION ALL
SELECT * FROM suspicious_procs

For deeper triage of any host with hits, also pull SELECT * FROM netstat() filtered on the web service UID, and enumerate cron: SELECT * FROM glob(globs='/var/spool/cron/**') plus /etc/cron.d/** for entries created after September 4.

Remediation & Verification Script

The following Bash script helps a responder (1) identify the installed Magento version, (2) sweep for PHP web shells in web-accessible directories created since exploitation began, (3) hunt for foreign ELF binaries in writable paths, and (4) audit persistence via cron. Run it as root on each Magento host. It is read-only — it reports, it does not delete. Quarantine decisions belong to your IR lead.

#!/usr/bin/env bash
# StyleSmuggler (CVE-2026-75650) - Magento/Adobe Commerce triage script
# Security Arsenal - read-only host assessment

DOCROOTS="/var/www/html /var/www /srv/www /usr/share/nginx/html"
SINCE="2026-09-04"

echo "===== [1] Magento version ====="
for d in $DOCROOTS; do
  if [ -f "$d/bin/magento" ]; then
    echo "[*] Found Magento at $d"
    php "$d/bin/magento" --version 2>/dev/null
    grep -h "'version'" "$d/app/etc/env.php" 2>/dev/null
  fi
done

echo "===== [2] PHP files in web-served dirs modified since $SINCE ====="
for d in $DOCROOTS; do
  for sub in pub/media pub/static media; do
    if [ -d "$d/$sub" ]; then
      find "$d/$sub" -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) \
        -newermt "$SINCE" -printf '%T+ %u %p\n' 2>/dev/null
    fi
  done
done

echo "===== [3] Known web shell function signatures in media/static dirs ====="
for d in $DOCROOTS; do
  grep -rEl 'eval\(|assert\(|gzinflate\(|str_rot13\(|base64_decode\(|shell_exec\(|passthru\(|proc_open\(' \
    "$d/pub/media" "$d/pub/static" 2>/dev/null | head -50
done

echo "===== [4] Foreign ELF binaries in world-writable paths ====="
find /tmp /var/tmp /dev/shm -type f -newermt "$SINCE" -exec file {} \; 2>/dev/null | grep -i 'ELF'
find /tmp /var/tmp /dev/shm -type f -executable -newermt "$SINCE" -printf '%T+ %u %m %p\n' 2>/dev/null

echo "===== [5] Processes owned by web user with unusual exe paths ====="
for u in www-data nginx apache; do
  ps -u "$u" -o pid,etimes,comm,args 2>/dev/null | grep -E '/tmp|/var/tmp|/dev/shm|media|static'
done

echo "===== [6] Cron persistence audit ====="
ls -la --time-style=long-iso /etc/cron.d/ /var/spool/cron/ /var/spool/cron/crontabs/ 2>/dev/null
grep -rEn 'curl|wget|/tmp|/var/tmp|base64|php ' /etc/cron.d/ /var/spool/cron/ 2>/dev/null

echo "===== [7] Recent outbound connections from web processes ====="
ss -tnp 2>/dev/null | grep -E 'php|nginx|apache|httpd'

echo "===== Triage complete. Preserve output before remediation. ====="

Remediation

Priority 1 — Patch immediately. Apply Adobe's security update for CVE-2026-75650 to all Adobe Commerce and Magento Open Source instances, including staging and development environments that are reachable from the internet (staging hosts are routinely used as pivot points and are frequently less monitored). Pull the official patch and affected-version matrix directly from Adobe's security advisory (helpx.adobe.com/security) and the Magento security center — do not rely on third-party mirrors. Given confirmed in-the-wild exploitation since September 4, treat this as an emergency-change candidate and expect CISA KEV inclusion to follow; monitor the KEV catalog for the associated federal remediation deadline, which typically lands at 2–3 weeks for actively exploited CVSS 10.0 issues.

Priority 2 — Patch-and-hunt, not patch-and-forget. With three weeks of pre-patch exploitation, a meaningful fraction of patched hosts are already compromised. After patching, run the triage script above on every Magento host, and hunt retroactively to September 4 in your web access logs for anomalous requests to the vulnerable component, spikes in requests from single source IPs, and any request pattern immediately followed by a PHP file appearing under pub/media/ or pub/static/.

Priority 3 — Deny PHP execution in media/static. Regardless of patch status, harden nginx/Apache to return 403 for *.php, *.phtml, and *.phar requests under pub/media/ and pub/static/. This is a durable compensating control that breaks the entire web shell persistence class, not just this CVE. Also disable execution permissions (noexec) on /tmp, /var/tmp, and /dev/shm where the application tolerates it — this directly constrains the Rust payload staging behavior.

Priority 4 — Contain the blast radius. Verify network segmentation between the web tier and the database/payment systems; the web service account should reach the database only on its required port from the application tier. Rotate all credentials reachable from the Magento host if any triage indicator fires: database credentials in app/etc/env.php, admin panel accounts, API/integration tokens, and any SSH keys present on the host. Enforce 2FA on all Magento admin accounts and restrict admin panel access by source IP.

Priority 5 — PCI-DSS obligations. If your storefront is in PCI scope and you find evidence of compromise, engage your IR retainer and assess notification obligations with your QSA and acquirer. Preserve forensic evidence (memory capture, web logs, the triage output) before rebuilding — rebuilds from known-good images are the correct end state for any host with confirmed web shell or Rust payload presence.

Final Assessment

StyleSmuggler follows a pattern we've watched mature over the past several years of Magento exploitation campaigns: a maximum-severity flaw in a universally internet-exposed platform, exploited quietly for weeks, monetized through persistent access that survives casual cleanup. The addition of a compiled Rust payload signals that the operators behind this campaign are investing in evasion durability — signature-only defenses will miss it. Behavioral detection on web-process child execution, file integrity monitoring scoped to media directories, and egress baselining on the web tier are what separate the organizations that find this in hours from those that find it in a PCI forensic investigation.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub