Adobe Patches Magento Zero-Day Exploited to Deploy Rust Backdoor and PHP Web Shell

Summary

Adobe has released hotfix patches for a critical remote code execution vulnerability impacting Adobe Commerce and Magento Open Source. Tracked as CVE-2026-75650 with a maximum CVSS score of 10.0, the zero-day flaw has been actively leveraged by threat actors to deploy Rust backdoors and PHP web shells.

Key Takeaways

1. Adobe on Monday released security patches to address a maximum-severity flaw impacting Adobe Commerce and Magento Open Source that has come under active exploitation in the wild.
2. The vulnerability, now tracked as CVE-2026-75650 (CVSS score: 10.0), has been codenamed StyleSmuggler by Sansec, which discovered zero-day exploitation starting September 4, 2026.
3. "To help resolve the vulnerability for the affected products and versions, you must apply the VULN-39341 patch (depending on your version) and rotate your encryption keys," Adobe said.

Statement Breakdown

• Claimed Facts: 85% of statements the article presents as facts
• Opinions: 15% of statements classified as editorial or subjective
• Claims: 0% of statements surfaced for additional reader evaluation

Credibility & Bias Reasoning

Credibility assessment: The report provides specific technical details regarding a severe vulnerability, referencing official advisories and named cybersecurity research organizations. Key claims directly cite Adobe and independent threat monitoring firms. The information is corroborated by version tables and remediation steps.

Bias assessment: Technical and Objective. The article adheres to straightforward, factual reporting on a software security flaw. It avoids sensationalism and presents actionable vendor advisories and technical context without editorial spin.

Note: This report details an actively exploited maximum-severity vulnerability based on official vendor disclosures.

Credibility flag: Verified Security Advisory

Claimed Facts (5)

• Reports the factual release of security patches by the vendor.
• Cites verifiable CVE metadata, naming, and discovery date.
• Explains the verifiable technical mechanism of the exploit chain.
• States checkable download availability information.
• Details specific observed post-exploitation payloads.

Opinions (5)

• Vendor evaluation of potential impact and severity context.
• Represents formal remediation advice and recommendations from the software vendor.
• Reflects threat intelligence analysis and characterization of malware payloads.
• Represents a security firm's assessment and reconstruction of attack timelines.
• Technical interpretation by a researcher describing the mechanism of the exploit chain.

Claims (5)

• Included as placeholder due to zero questionable claims present in this factual technical advisory.
• Included as placeholder due to zero questionable claims present in this factual technical advisory.
• Included as placeholder due to zero questionable claims present in this factual technical advisory.
• Included as placeholder due to zero questionable claims present in this factual technical advisory.
• Included as placeholder due to zero questionable claims present in this factual technical advisory.

Key Sources

• Adobe — Software Vendor
• Sansec — E-Commerce Security Company
• Disrex — Netherlands-based E-Commerce Development Platform
• Ravie Lakshmanan — Security Journalist at The Hacker News