An Attacker Leaves His Own Door Open An attacker hacked thousands of shops. Then he left the door to his own infrastructure open. A check of an exposed server run by the Lockster operator showed the scale of the damage. Through a critical zero-day in Magento Open Source and Adobe Commerce, attackers compromised at least 3,834 sites. Most were online stores.

# 132,158 Observable Magento Stores: Sizing the Population Exposed in the StyleSmuggler Window ## Opening CVE-2026-75650 (StyleSmuggler) was exploited from 4 September 2026, and Adobe's hotfix VULN-39341 arrived on 7 September. Between those dates, every internet-reachable Adobe Commerce or Magento Open Source deployment was in the exposure window, and the post-compromise Rust backdoor survives patching. Sizing that population with a real measurement beats estimating it. On 19 September 2026, the ZoomEye query `app="Magento"` returned 132,158 observable services. ## Context and method The query used the official `app` fingerprint field with `sub_type=all` and requested country and port facets. A fingerprint match means the platform's scanning vantage observed Magento characteristics on the service. It does not mean the deployment ran a vulnerable version during the exposure window - version data is not included in this query - and it does not count stores behind CDNs, which the Magento population intersects heavily. ## What the facets show Country facet: * United States: 61,553 * Germany: 12,101 * United Kingdom: 7,612 * China: 4,982 * Belgium: 4,916 * The Netherlands: 4,456 * France: 4,448 * Ireland: 3,932 * Singapore: 3,770 * India: 3,012 Port facet: * Port 443: 60,327 * Port 80: 50,995 * Port 8080: 5,367 * Port 8443: 2,783 * Port 2086: 1,445 (a cPanel-associated port) * Port 2082: 1,422 * Port 2052: 1,409 Two distributions carry information for incident-response planning. The country concentration (46.6% US in the top-10 subset) reflects where the e-commerce hosting market concentrates, and matches where Sansec observed exploitation. The cPanel-associated ports (2082/2086/2095 together over 4,200 services) indicate shared-hosting Magento deployments, a segment that typically patches slowest and has the least in-house incident-response capability - the exact population the StyleSmuggler backdoor persistence model targets. ## From population to prioritization The measurement converts to a work queue in three steps: 1. **Version triage.** Fingerprint match is not version data. Stores that applied VULN-39341 before 7 September were in the window; stores that applied it after were in it longer. Order internal stores by hotfix application date, not by alarm level. 2. **Persistence sweep.** The Rust backdoor impersonates kernel threads (`[kworker/u:8:0]`, `fc-cache`, `chronyd`) and communicates over UDP 123 as fake NTP. Sweep `pub/media` for PHP, check process tables for those names, and review egress for UDP 123 regardless of patch date. 3. **Shared-hosting follow-up.** The cPanel-port population deserves separate follow-up: those operators often cannot sweep their own hosts and depend on the hosting provider. ## Limits This count bounds the observable population, not the victim count. Sansec and Disrex observed exploitation within minutes of disclosure in at least one incident, which suggests the actual exploited subset was small but fast-moving. The fingerprint also cannot see stores behind CDN fronts or on private networks. The number is a denominator for risk conversations, not a victim list. ## References * ZoomEye v2 API responses recorded 2026-09-19: `app="Magento"` with country and port facets * Adobe APSB26-146 and hotfix VULN-39341 (exploitation from 4 September 2026, hotfix 7 September 2026) * Sansec StyleSmuggler research and Disrex incident timeline * CISA KEV entry for CVE-2026-75650, added 8 September 2026

A zero-day vulnerability named StyleSmuggler in Magento and Adobe Commerce is being actively exploited. The security flaw affects online shops based on these e-commerce platforms and remains unpatched. The vulnerability allows attackers to target these systems, though specific technical details about the exploitation method or impact are not provided in the brief article excerpt.

A zero-day vulnerability designated CVE-2026-75650, named StyleSmuggler, affects Magento and Adobe Commerce platforms. The flaw has been actively exploited since September 4, 2026, and has already resulted in compromised online stores. A security patch has been released to address the vulnerability. The exploitation occurred before the patch became available, confirming its zero-day status at the time of active attacks.

# When the Payment-Failure Email Is the Exploit: Inside the Magento Template Rendering Chain of CVE-2026-75650 ## Opening CVE-2026-75650 is an unauthenticated remote code execution vulnerability in Adobe Commerce and Magento Open Source that reached the CISA Known Exploited Vulnerabilities catalog on 8 September 2026. Dutch ecommerce security firm Sansec, which named the campaign StyleSmuggler, documented exploitation starting 4 September 2026. Adobe published the emergency hotfix VULN-39341 on 7 September 2026 under advisory APSB26-146. The relevant window is those three days. A store that was compromised before the hotfix did not become safe by applying it. ## Technical context The flaw is classified as CWE-1336, improper neutralization of special elements used in a template engine. The affected version range covers Adobe Commerce 2.4.4 through 2.4.9 (through the 2026-aug builds), Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. Stores that applied the August 2026 monthly patch remained vulnerable, which is why the hotfix was distributed separately. Adobe assigned a CVSS 10.0 to the flaw. The attack requires no authentication and no user interaction. ## How the attack chain works Public analyses from Sansec and the Fortbridge proof-of-concept repository describe the sequence consistently: 1. The attacker places crafted, poisoned data where Magento generates its own records - error reports and payment transaction data. 2. The attacker triggers the standard "Payment Transaction Failed Reminder" email. Rendering that template is the exploit moment: the template engine processes the poisoned data with inadequate neutralization. 3. Through an object-injection chain into Magento's dependency-injection container, the processed data is included and executed as PHP with web-server privileges. 4. Observed payloads include a Rust backdoor disguised as kernel-thread and system processes such as `[kworker/u:8:0]`, `fc-cache`, or `chronyd`, communicating over UDP 123 disguised as NTP traffic, and small PHP web shells written into media directories. One detail matters for detection: a burst of "payment failed" notification emails without matching failed orders is a reasonable early indicator, because the exploit ride on the same rendering path. ## Defensive implications Patching closes the flaw but does not evict an intruder. The post-compromise checklist from the primary sources is concrete: * Inspect `pub/media` for PHP files that do not belong there. * Check running processes for names imitating kernel threads and font or time services, and watch for egress to UDP 123. * Rotate credentials in a specific order: encryption keys first, because they protect everything else, then admin passwords, API tokens (REST, GraphQL, SOAP), payment gateway credentials, database accounts, and SSH keys. * Run a targeted scanner such as Sansec's eComscan, which identifies the Rust backdoor and secondary web shells. For EOL versions such as 2.4.0-2.4.3, only community backports exist; they are unverified by Adobe and require staging validation before production use. The StyleSmuggler case is a reminder that transactional email rendering is code execution in waiting. Treat "the store sends email" as an attack surface, not plumbing. ## References * Adobe Security Bulletin APSB26-146 and hotfix VULN-39341 * Sansec research on StyleSmuggler exploitation and detection * CISA KEV catalog entry added 8 September 2026 * Fortbridge StyleSmuggler proof-of-concept repository * Disrex incident timeline (first exploitation confirmed 4 September 2026 at 22:20 UTC; compromise observed 50 minutes later)

The Reddit post shares a link to research about a Magento vulnerability called StyleSmuggler that involves unauthenticated remote code execution (RCE). The research is published at fortbridge.co.uk and describes a report poisoning attack that leads to code execution.

A critical Adobe Commerce and Magento zero-day dubbed StyleSmuggler is under active attack, allowing hackers to execute PHP code without authentication.

An urgent hotfix is available to patch a critical vulnerability in Magento and Adobe Commerce. Update your store's software as soon as you can.

An urgent hotfix is available to patch a critical vulnerability in Magento and Adobe Commerce. Update your store's software as soon as you can.

Two unauthenticated requests: poison a Magento failure report, then drive the email template system into the DI compiler that includes it. Full chain analysis, lab PoC, and mitigations.

Two unauthenticated requests: poison a Magento failure report, then drive the email template system into the DI compiler that includes it. Full chain analysis, lab PoC, and mitigations.

This issue of The Cybersecurity Pulse covers major developments across security research, AI agents, and enterprise defenses, including a WeChat exploit chain, risky LG TV privacy behavior, and attackers exploiting StyleSmuggler in Magento and Adobe Commerce. It also highlights major industry moves such as CrowdStrike’s SecOps push, OpenAI’s GPT-6 Astra, Palo Alto Networks’ acquisition of Console, and ClickHouse’s acquisition of RunReveal. #WeChat #LG #StyleSmuggler #Magento #AdobeCommerce #CrowdStrike #OpenAIAstra #Console #RunReveal

El ataque inyecta código PHP en el sistema de plantillas de Magento y dispara la ejecución al reenviar el correo de aviso de pago fallido, sin necesitar interacción del usuario. (Fuente: SecurityWeek) Actores de amenaza están explotando una vulnerabilidad de día cero en las plataformas de comercio electrónico Adobe Commerce y Magento para instalar puertas traseras en tiendas online vulnerables, según reportó la firma de ciberseguridad Sansec.