Cet article documente une campagne d'exploitation active de la vulnérabilité StyleSmuggler (CVE-2026-75650) ciblant des boutiques Magento / Adobe Commerce dans plusieurs régions du monde. La campagne a été détectée entre le 9 et le 13 septembre 2026.

At a glance Malware family PSK Agent (Go-based RAT), a shell-script dropper, and a PHP webshell Threat actor Unnamed; likely Chinese-speaking, per Imperva (moderate confidence) Targets Magento and Adobe Commerce stores in Western Europe, North America, and Asia-Pacific Delivery vector StyleSmuggler exploitation of CVE-2026-75650 Key capabilities Remote command execution, SOCKS5 proxying, DNS victim tracking, persistence TL;DR Between September 9 and 13, 2026, Imperva detected attacks that dropped the PSK Agent RAT on Magento and Adobe Commerce stores.

Attackers are abusing a serious flaw in Adobe Commerce and Magento to install a hidden remote access tool called PSK Agent on online store servers. Once it is running, they can run commands, route traffic through the server, and keep access even after a restart. The flaw, named StyleSmuggler and tracked as CVE-2026-75650, was first revealed as a zero-day in early September. Sansec said it let anyone run code on a store without logging in, and it affected every current version, including 2.4.9. Within days, more than one group was using it to drop different malware. Researchers at Imperva noted the PSK Agent activity after tracking a coordinated campaign between September 9 and September 13, 2026. They saw it hit stores in Western Europe, North America and the Asia-Pacific region. The malware had a 0% detection rate on VirusTotal at the time of analysis, so basic file scanning would likely have missed it. Hackers Exploit Adobe Commerce Zero-Day The attackers went after one endpoint, /paypal/transparent/response/, which matches the first step of StyleSmuggler. In that step, the attacker places PHP code in the request’s query string. Magento then logs the error and writes that code into a report file under var/report/. A second request to /graphql uses attacker-controlled styles values to load the poisoned file and run the code. Imperva tracked five attack clusters coming from a small set of IP addresses. The near-identical payloads point to automated tools that scan for weak stores at scale. The download link for the first script, psk_agent.sh, showed up 96 times across 12 payload variants, which suggests the attackers kept using one stable delivery path. The PHP payload tries the shell_exec, system and exec functions in turn. If one is blocked, it quietly moves to the next. It then runs a curl command that pipes the script straight into bash, so the first command never touches the disk. The 3,313-byte script looks for a folder that is both writable and executable, such as /tmp or /dev/shm. It then downloads the next stage with curl, wget or Python and starts it in the background. That stage is chi_down, a heavily obfuscated 10.5 MB Go program. It can run shell commands, collect host details and proxy traffic through SOCKS5. It also talks to its operators over HTTP, HTTPS and encrypted channels. Its launch arguments, -checkagent=false -maintain=true, suggest it is meant to survive restarts. DNS Beacons, Webshells and Signs of a Chinese-Speaking Operator Some payloads also told the attackers when an attack worked. The code put the victim’s hostname into a unique subdomain under 0f851bdc9d.ddns.1433.eu.org and then made both an HTTP and a DNS request. The attackers controlled the DNS servers, so the lookup alone proved success, even if the web request failed. That gave them a quiet, running list of hacked servers. In some cases, the operators added a second way back in. They downloaded t4.php and saved it as zer4.php in public folders such as pub/media/. This 910-line file manager and PHP web shells like it let attackers edit files, upload or download data, and run system commands. It uses PHP’s Foreign Function Interface to call libc directly, which can still work when common PHP functions are turned off. The same hardcoded AES-256-CBC key appeared in every sample, which hints at one operator or a shared toolkit. Imperva found Chinese-language comments in the script, with names such as chinow and chi_down in the infrastructure. The researchers rate a Chinese-speaking operator as likely, with moderate confidence. They warn that language clues can be planted or copied, and they do not name a specific group. They also stress that this applies only to PSK Agent, since other attackers have used the same flaw to drop a Rust backdoor and different PHP droppers. Store owners should apply Adobe’s VULN-39341 hotfix. That only closes the entry point, though. It does not remove a RAT, webshell or stolen credentials that were planted earlier. A server with any of these signs should be treated as fully compromised. Check for psk_agent.sh, chi_down, zer4.php and fake process names like kworker, fc-cache and chronyd. Rotate the Magento encryption key, database logins, admin credentials, API tokens and SSH keys. Watch for DNS lookups to the beacon domain and for web servers making unexpected outbound connections. Zscaler also saw some of the same download infrastructure in Citrix NetScaler attacks , but that overlap is only a lead and does not prove the same actor is behind both. Magento stores have long been a favorite target. A past campaign showed how fast things can spread, when the CosmicSting flaw hit thousands of stores. Patching quickly and checking for earlier compromise remain the best defenses. The full technical breakdown is in Imperva’s research blog . Indicators of compromise (IoCs):- File Hashes File SHA-256 Role psk_agent.sh fc9bcdb3a442880e585d6fe4ddaec62d62af641f8ac3cceeb6a553985a7d9094 Shell-script dropper chi_down 6dbfb04c063170af13a8151346898ebcb9c4b827fa8d16a96018419b746601a6 Go RAT t4.php / zer4.php 1811a1d63310737e969348d16d95f80bf56f8e8896fc64eb5d6d6dc314e2a547 PHP webshell Network Indicators Indicator Type Role 132.243.238.178 IP Attack source 86.107.100.105 IP Attack source 185.18.222.13 IP Attack source 64.204.130.9 IP Attack source 99.84.67.186 IP Reported StyleSmuggler C2 185.157.160.251 IP ntp.timesync.to C2 transfer.chinow[.]abrdns[.]com Domain Dropper and RAT delivery transfer.onlypsk[.]abrdns[.]com Domain Webshell delivery .0f851bdc9d.ddns.1433.eu.org Domain DNS and HTTP success beacon ntp.timesync[.]to Domain NTP-shaped C2 windwsecurity[.]run Domain RAT C2 Note:   IP addresses and domains are intentionally Qdefanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post Hackers Exploit Adobe Commerce Zero-Day to Deploy PSK Agent RAT and Remotely Control Servers appeared first on Cyber Security News .

Attackers exploit Magento's StyleSmuggler zero-day to install PSK Agent, enabling persistent remote access to online stores.118 characters

Adobe has released an emergency fix for CVE-2026-75650, an actively exploited max-severity zero-day vulnerability dubbed StyleSmuggler, that impacts multiple versions of Magento and Adobe Commerce.

StyleSmuggler Magento zero-day is under active attack, letting unauthenticated attackers execute code and install backdoors on stores.

A zero-day vulnerability dubbed "StyleSmuggler" affecting all versions of Magento and Adobe Commerce is being exploited in attacks to deploy a backdoor.

Adobe patches actively exploited CVE-2026-75650 in Commerce and Magento, used to deploy Linux backdoors and PHP web shells.

Hackers are exploiting a zero-day vulnerability in Adobe Commerce and Magento e-commerce platforms to backdoor vulnerable online stores.

Security researchers have discovered an actively exploited, unauthenticated remote code execution vulnerability affecting installations of Magento Open Source and Adobe Commerce.

Sansec says attackers exploit an unpatched Magento and Adobe Commerce flaw to run server code without authentication and install persistent backdoors.

An Attacker Leaves His Own Door Open An attacker hacked thousands of shops. Then he left the door to his own infrastructure open. A check of an exposed server run by the Lockster operator showed the scale of the damage. Through a critical zero-day in Magento Open Source and Adobe Commerce, attackers compromised at least 3,834 sites. Most were online stores.

# 132,158 Observable Magento Stores: Sizing the Population Exposed in the StyleSmuggler Window ## Opening CVE-2026-75650 (StyleSmuggler) was exploited from 4 September 2026, and Adobe's hotfix VULN-39341 arrived on 7 September. Between those dates, every internet-reachable Adobe Commerce or Magento Open Source deployment was in the exposure window, and the post-compromise Rust backdoor survives patching. Sizing that population with a real measurement beats estimating it. On 19 September 2026, the ZoomEye query `app="Magento"` returned 132,158 observable services. ## Context and method The query used the official `app` fingerprint field with `sub_type=all` and requested country and port facets. A fingerprint match means the platform's scanning vantage observed Magento characteristics on the service. It does not mean the deployment ran a vulnerable version during the exposure window - version data is not included in this query - and it does not count stores behind CDNs, which the Magento population intersects heavily. ## What the facets show Country facet: * United States: 61,553 * Germany: 12,101 * United Kingdom: 7,612 * China: 4,982 * Belgium: 4,916 * The Netherlands: 4,456 * France: 4,448 * Ireland: 3,932 * Singapore: 3,770 * India: 3,012 Port facet: * Port 443: 60,327 * Port 80: 50,995 * Port 8080: 5,367 * Port 8443: 2,783 * Port 2086: 1,445 (a cPanel-associated port) * Port 2082: 1,422 * Port 2052: 1,409 Two distributions carry information for incident-response planning. The country concentration (46.6% US in the top-10 subset) reflects where the e-commerce hosting market concentrates, and matches where Sansec observed exploitation. The cPanel-associated ports (2082/2086/2095 together over 4,200 services) indicate shared-hosting Magento deployments, a segment that typically patches slowest and has the least in-house incident-response capability - the exact population the StyleSmuggler backdoor persistence model targets. ## From population to prioritization The measurement converts to a work queue in three steps: 1. **Version triage.** Fingerprint match is not version data. Stores that applied VULN-39341 before 7 September were in the window; stores that applied it after were in it longer. Order internal stores by hotfix application date, not by alarm level. 2. **Persistence sweep.** The Rust backdoor impersonates kernel threads (`[kworker/u:8:0]`, `fc-cache`, `chronyd`) and communicates over UDP 123 as fake NTP. Sweep `pub/media` for PHP, check process tables for those names, and review egress for UDP 123 regardless of patch date. 3. **Shared-hosting follow-up.** The cPanel-port population deserves separate follow-up: those operators often cannot sweep their own hosts and depend on the hosting provider. ## Limits This count bounds the observable population, not the victim count. Sansec and Disrex observed exploitation within minutes of disclosure in at least one incident, which suggests the actual exploited subset was small but fast-moving. The fingerprint also cannot see stores behind CDN fronts or on private networks. The number is a denominator for risk conversations, not a victim list. ## References * ZoomEye v2 API responses recorded 2026-09-19: `app="Magento"` with country and port facets * Adobe APSB26-146 and hotfix VULN-39341 (exploitation from 4 September 2026, hotfix 7 September 2026) * Sansec StyleSmuggler research and Disrex incident timeline * CISA KEV entry for CVE-2026-75650, added 8 September 2026

A zero-day vulnerability named StyleSmuggler in Magento and Adobe Commerce is being actively exploited. The security flaw affects online shops based on these e-commerce platforms and remains unpatched. The vulnerability allows attackers to target these systems, though specific technical details about the exploitation method or impact are not provided in the brief article excerpt.

A zero-day vulnerability designated CVE-2026-75650, named StyleSmuggler, affects Magento and Adobe Commerce platforms. The flaw has been actively exploited since September 4, 2026, and has already resulted in compromised online stores. A security patch has been released to address the vulnerability. The exploitation occurred before the patch became available, confirming its zero-day status at the time of active attacks.

# When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650 ## Opening CVE-2026-75650 is an unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source that reached the CISA Known Exploited Vulnerabilities catalog on 8 September 2026. Dutch ecommerce security firm Sansec, which named the campaign StyleSmuggler, documented exploitation starting 4 September 2026. Adobe published the emergency hotfix VULN-39341 on 7 September 2026 under advisory APSB26-146. The relevant window is those three days. A store that was compromised before the hotfix did not become safe by applying it. ## Technical context The flaw is classified as CWE-1336, improper neutralization of special elements used in a template engine. The affected version range covers Adobe Commerce 2.4.4 through 2.4.9 (through the 2026-aug builds), Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. Stores that applied the August 2026 monthly patch remained vulnerable, which is why the hotfix was distributed separately. Adobe assigned a CVSS 10.0 to the flaw. The attack requires no authentication and no user interaction. ## How the attack chain works Public analyses from Sansec and the Fortbridge proof-of-concept repository describe the sequence consistently: 1. The attacker places crafted, poisoned data where Magento generates its own records - error reports and payment transaction data. 2. The attacker triggers the standard "Payment Transaction Failed Reminder" email. Rendering that template is the exploit moment: the template engine processes the poisoned data with inadequate neutralization. 3. Through an object-injection chain into Magento's dependency-injection container, the processed data is included and executed as PHP with web-server privileges. 4. Observed payloads include a Rust backdoor disguised as kernel-thread and system processes such as `[kworker/u:8:0]`, `fc-cache`, or `chronyd`, communicating over UDP 123 disguised as NTP traffic, and small PHP web shells written into media directories. One detail matters for detection: a burst of "payment failed" notification emails without matching failed orders is a reasonable early indicator, because the exploit ride on the same rendering path. ## Defensive implications Patching closes the flaw but does not evict an intruder. The post-compromise checklist from the primary sources is concrete: * Inspect `pub/media` for PHP files that do not belong there. * Check running processes for names imitating kernel threads and font or time services, and watch for egress to UDP 123. * Rotate credentials in a specific order: encryption keys first, because they protect everything else, then admin passwords, API tokens (REST, GraphQL, SOAP), payment gateway credentials, database accounts, and SSH keys. * Run a targeted scanner such as Sansec's eComscan, which identifies the Rust backdoor and secondary web shells. For EOL versions such as 2.4.0-2.4.3, only community backports exist; they are unverified by Adobe and require staging validation before production use. The StyleSmuggler case is a reminder that transactional email rendering is code execution in waiting. Treat "the store sends email" as an attack surface, not plumbing. ## References * Adobe Security Bulletin APSB26-146 and hotfix VULN-39341 * Sansec research on StyleSmuggler exploitation and detection * CISA KEV catalog entry added 8 September 2026 * Fortbridge StyleSmuggler proof-of-concept repository * Disrex incident timeline (first exploitation confirmed 4 September 2026 at 22:20 UTC; compromise observed 50 minutes later)

The Reddit post shares a link to research about a Magento vulnerability called StyleSmuggler that involves unauthenticated remote code execution (RCE). The research is published at fortbridge.co.uk and describes a report poisoning attack that leads to code execution.

A critical Adobe Commerce and Magento zero-day dubbed StyleSmuggler is under active attack, allowing hackers to execute PHP code without authentication.