Adobe rushed out patches for a maximum-severity Magento zero-day that attackers were already using to plant a Rust backdoor and PHP web shell. Here's what you need to know.
### The Wake-Up Call Every Magento Store Owner Needs to Hear
Imagine waking up to find your online store silently compromised. That's exactly what happened to some Adobe Commerce and Magento Open Source users starting September 4, 2026. A maximum-severity vulnerability—now tracked as CVE-2026-75650 with a CVSS score of 10.0—was actively exploited in the wild before Adobe released patches on Monday.
The flaw, codenamed StyleSmuggler by the security researchers at Sansec who discovered it, allowed attackers to deploy a Rust-based backdoor and a PHP web shell. If that sounds like technical jargon, here's the plain English version: cybercriminals found a way to sneak into e-commerce websites, set up a hidden remote control, and then use that control to run any code they wanted on the server. Not good.
### Why This One Is Different
A CVSS score of 10.0 is as bad as it gets. It means the vulnerability is remotely exploitable, requires no authentication, and can lead to a complete system takeover. But what makes StyleSmuggler particularly nasty is the combination of tools the attackers used.
- **Rust backdoor**: A stealthy program written in the Rust programming language that gives attackers persistent access to your server.
- **PHP web shell**: A script that lets them execute commands through your website, often disguised as a harmless file.
Together, these two tools create a perfect storm. The backdoor survives reboots and updates, while the web shell provides an easy-to-use interface for further attacks—like stealing customer data, installing ransomware, or turning your store into a botnet node.
> "This update resolves a critical vulnerability that was already being exploited in the wild. If you haven't patched yet, you're essentially leaving your front door wide open." — Security researcher familiar with the incident
### What You Should Do Right Now
If you run a Magento or Adobe Commerce store, stop reading and go patch. Seriously. The fix is available, and it takes minutes to apply. Delaying is not an option when attackers are actively scanning for vulnerable sites.
Here's your action checklist:
- Apply the latest security patch from Adobe immediately.
- Check your server logs for any suspicious activity around September 4, 2026, and after.
- Look for unfamiliar files, especially PHP scripts with odd names or Rust binaries in unexpected directories.
- Change all administrative passwords and API keys as a precaution.
- Consider a professional security audit if you suspect you were targeted.
### The Bigger Picture for E-Commerce Security
This incident isn't just about one patch. It's a reminder that e-commerce platforms are prime targets because they hold valuable customer data and payment information. Attackers are getting smarter, using advanced languages like Rust to evade detection and maintain long-term access.
For store owners, the lesson is simple: stay vigilant. Subscribe to security advisories, enable automatic updates where possible, and never assume you're too small to be a target. Because in the world of cybercrime, everyone is fair game.
And if you're wondering whether your store was affected—don't wait for a notification. Check your logs, verify your files, and patch now. Your customers are counting on you.
