A zero day in Magento was exploited for three days before Adobe shipped a fix

The security company Sansec has identified active exploitation of a critical vulnerability in Magento Open Source and Adobe Commerce. The flaw is called StyleSmuggler, is tracked as CVE-2026-75650 and scores 10.0. It lets an attacker without login execute code on the server by smuggling PHP into Magento's template system. Attacks began on 4 September 2026, three days before Adobe released an emergency hotfix. Versions 2.4.4 through 2.4.9 are affected, including installations with recent security patches.

According to Sansec, the vulnerability has been used to install backdoors disguised as ordinary Linux processes, with names such as kworker, fc-cache and chronyd. Some variants communicate through traffic designed to resemble ordinary NTP, and a separate attacker has used the flaw to plant a PHP web shell. The advice is to apply Adobe's VULN-39341 hotfix immediately, investigate servers for evidence of compromise, and rotate the Magento encryption key and every credential it protected. The hotfix does not remove malware that is already in place.

What this means for you if you run a shop on Magento

Three days is a long time when the flaw gives code execution without login and the shop sits on the internet. If your shop ran an affected version in that window, the question is not whether you should patch, but whether someone got there first. The backdoors are built to look like system processes, and traffic resembling NTP slips through most firewalls. That makes a quick glance at the process list worth little. You have to compare against what you know should be there.

The encryption key is what makes this bigger than an ordinary update. It protects what the shop stores encrypted, such as integration keys and credentials, and if someone has had code running on the server, you must assume the key has been read. Rotating the key and everything it protected is therefore part of the fix, not an extra. If an agency runs the shop for you, ask for written confirmation of what was done, with timestamps.

Berigo recommends

• Apply the VULN-39341 hotfix to every Magento and Adobe Commerce installation on versions 2.4.4 through 2.4.9 without delay.
• Look for processes named kworker, fc-cache or chronyd that run from the wrong place or under the wrong user, and for unknown PHP files in the web directories.
• Review outbound traffic from the shop server, in particular NTP like traffic to addresses you do not recognise.
• Rotate the Magento encryption key and every key, password and API credential it has protected.
• Ask your hosting provider to document what was done, when, and which traces were found.