What Happened
Adobe released an emergency hotfix for CVE-2026-75650, a maximum-severity, unauthenticated remote code execution flaw in Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, rated 10.0 on the CVSS scale. E-commerce security firm Sansec dubbed the flaw StyleSmuggler and traced exploitation back to at least September 4, three days before Adobe’s fix arrived. The vulnerability abuses Magento’s template-processing chain, writing attacker-controlled PHP code into a file Magento later loads through its dependency-injection scanner, resulting in code execution on the server. One attacker used the flaw to plant a Rust-based Linux backdoor disguising its command-and-control traffic as Network Time Protocol requests, while a second, unrelated attacker deployed a 485-byte PHP web shell. Affected versions span Adobe Commerce 2.4.4 through 2.4.9, Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. Details are available from BleepingComputer.
Why This Matters for Canadian Organizations
Magento and Adobe Commerce power a large share of small and mid-sized Canadian retailers who lack the in-house security teams larger e-commerce platforms maintain, making a pre-authentication, maximum-severity flaw with confirmed backdoor deployment a direct threat to holiday-season revenue and customer trust. A compromised storefront exposes customer names, addresses, and payment-adjacent data, triggering breach-notification duties under PIPEDA and provincial privacy statutes, along with PCI-DSS reporting obligations for merchants processing card payments. Because the backdoor persists after initial compromise, an unpatched Canadian store risks losing control of the server well beyond the point of applying a fix, and Adobe explicitly warns the hotfix has only been validated against August 2026 releases, leaving many merchants running older branches without confirmed compatibility.
What to Do
Magento and Adobe Commerce administrators should apply the VULN-39341 hotfix immediately, then follow Adobe’s full remediation sequence: enable maintenance mode, suspend cron jobs, and rotate every credential the platform touches, including administrator passwords, GraphQL integration tokens, OAuth client secrets, payment gateway API keys, database credentials, SSH keys, and API tokens. After rotation, flush the cache, restore cron execution, and disable maintenance mode before returning the store to production. Search server logs and the pub/media directory for signs of the reported backdoors, including unexplained NTP-like outbound traffic and unfamiliar “Payment Transaction Failed Reminder” emails, and treat any match as an active compromise requiring full incident response rather than a patch-and-move-on fix. Merchants on branches Adobe has not validated should test in staging before deploying to production. Updates are available from BleepingComputer.
