Magento Open Source and Adobe Commerce StyleSmuggler zero-day actively exploited security flaw
Vulnerability
Summary
Hide ▲
Show ▼
CVE-2026-75650 / StyleSmuggler is an actively exploited zero-day affecting Magento Open Source and Adobe Commerce. Exploitation was observed since at least September 4, with attacks using PHP code injection to plant a backdoor on vulnerable sites and persist through disguised activity such as Payment Transaction Failed Reminder emails and cron-based execution. Adobe has now issued an emergency fix and VULN-39341 hotfix with highest priority, and Sansec reported a separate attacker using the flaw to deploy a 485-byte PHP web shell.
Related Happenings
StyleSmuggler Rust-based backdoor deployment on Magento and Adobe Commerce hosts
Malware Activity
H score17
First: 07.09.2026 19:50
Last: 07.09.2026 19:50
Sources 1
How related:
Successful exploitation installs a small Rust-based backdoor as a background process, disguised as [kworker/u:8:0].
About this happening:
A Rust-based backdoor is being dropped on Magento and Adobe Commerce servers after StyleSmuggler exploitation, giving attackers remote command-and-control on Lin...
StyleSmuggler Rust-based backdoor deployment on Magento and Adobe Commerce hosts
Malware ActivityHow related: Successful exploitation installs a small Rust-based backdoor as a background process, disguised as [kworker/u:8:0].
About this happening: A Rust-based backdoor is being dropped on Magento and Adobe Commerce servers after StyleSmuggler exploitation, giving attackers remote command-and-control on Lin...
Adobe Commerce and Magento incorrect authorization flaw (CVE-2026-71362, exploitation attempts detected)
Vulnerability
H score40
First: 12.08.2026 23:54
Last: 12.08.2026 23:54
Sources 1
About this happening:
CVE-2026-71362 exploitation attempts against Adobe Commerce and Magento are now being blocked, creating customer-account hijack and private-data exposure risk for...
Adobe Commerce and Magento incorrect authorization flaw (CVE-2026-71362, exploitation attempts detected)
VulnerabilityAbout this happening: CVE-2026-71362 exploitation attempts against Adobe Commerce and Magento are now being blocked, creating customer-account hijack and private-data exposure risk for...
PushEngage, OptinMonster, and TrustPulse CDN script-tampering campaign
Campaign
H score89
First: 15.06.2026 12:59
Last: 15.06.2026 12:59
Sources 1
About this happening:
A multi-plugin supply-chain campaign targeted Awesome Motive WordPress plugins OptinMonster, TrustPulse, and PushEngage, with malicious JavaScript delivered th...
PushEngage, OptinMonster, and TrustPulse CDN script-tampering campaign
CampaignAbout this happening: A multi-plugin supply-chain campaign targeted Awesome Motive WordPress plugins OptinMonster, TrustPulse, and PushEngage, with malicious JavaScript delivered th...
Latest development: 15.06.2026 20:37
Awesome Motive said a server in its environment was compromised after exploitation of a known UpdraftPlus WordPress plugin flaw, allowing attackers to steal the CDN API key for a marketing website and modify JavaScript distributed through the company’s CDN. The company remediated the marketing site, moved it to a new server, and rotated all credentials, including the CDN API key, while stating that its application servers, source code, and account-data systems were not breached.
GorgonAgora fake .shop card-skimming campaign
Campaign
H score84
First: 05.06.2026 11:38
Last: 05.06.2026 11:38
Sources 1
About this happening:
The GorgonAgora campaign is using 5,714 fake .shop storefronts to steal payment data, widening card-theft risk across brand-impersonation checkout pages. The operation has...
GorgonAgora fake .shop card-skimming campaign
CampaignAbout this happening: The GorgonAgora campaign is using 5,714 fake .shop storefronts to steal payment data, widening card-theft risk across brand-impersonation checkout pages. The operation has...
Everest Forms Pro CVE-2026-3300 active exploitation wave
Exploitation Wave
H score87
First: 05.06.2026 11:38
Last: 05.06.2026 11:38
Sources 1
About this happening:
Active exploitation of CVE-2026-3300 in Everest Forms Pro is driving complete site compromise risk for WordPress sites. Attackers have been using the flaw for arbitrar...
Everest Forms Pro CVE-2026-3300 active exploitation wave
Exploitation WaveAbout this happening: Active exploitation of CVE-2026-3300 in Everest Forms Pro is driving complete site compromise risk for WordPress sites. Attackers have been using the flaw for arbitrar...
Timeline
-
08.09.2026 16:34 1 articles · 11d ago
Adobe issues emergency fix for exploited CVE-2026-75650
Mitigation Patch UpdateAdobe released an emergency fix for CVE-2026-75650, the max-severity StyleSmuggler zero-day affecting Adobe Commerce and Magento Open Source. The vendor assigned the highest priority rating and urged immediate installation of the VULN-39341 hotfix, while Adobe also said the flaw was being exploited in the wild. Sansec reported that a second attacker with unrelated tooling was observed using CVE-2026-75650 to deploy a 485-byte PHP web shell.
Show sources
- Adobe fixes critical Magento zero-day exploited to backdoor servers — www.bleepingcomputer.com — 08.09.2026 16:34
-
05.09.2026 23:14 3 articles · 13d ago
Magento Open Source and Adobe Commerce StyleSmuggler zero-day actively exploited security flaw
Initial DisclosureExploitation began on September 4, before Adobe had issued any advisory, CVE, patch, or workaround. The flaw allows unauthenticated code execution on Magento Open Source and Adobe Commerce store servers.
Show sources
- Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores — thehackernews.com — 05.09.2026 23:14
- Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores — thehackernews.com — 05.09.2026 23:14
- Magento StyleSmuggler zero-day exploited to deploy Linux backdoor — www.bleepingcomputer.com — 07.09.2026 19:50