Adobe’s September 11 update gives more Magento store owners a compatible emergency fix for StyleSmuggler. The attacks reveal why installing it is only part of the response: the entry point lives in Magento’s template handling, while the resulting backdoor can keep running as a separate server process. Adobe now provides version-specific patches for older builds and calls for replacement of potentially exposed credentials.
The initial attacks began September 4; the emergency fix arrived September 7. This is an expanded-remediation development, not a newly discovered attack today. Adobe identifies the flaw as CVE-2026-75650 and confirms exploitation against Commerce merchants.
A failed payment becomes the execution step
Sansec’s investigation describes an attack that first plants PHP in a file, such as an error report. A failed-payment email then brings Magento’s template machinery into the sequence: attacker-controlled styles properties let the poisoned content reach execution. The attacker does not need to sign in.
The important boundary is between content a store records and code its server is allowed to run. A payment error should produce a message, not turn an earlier file into a program. Here, the attacker arranges both the material that will be processed and the later event that processes it.
Blocking one storage route was insufficient in a merchant case reported by Sansec. An attempt against session storage failed; eight seconds later, the same operator succeeded through a file uploaded using Magento’s custom options. Moving sessions into Redis therefore does not resolve the underlying flaw.
The backdoor borrows a familiar process name
The payload developed its own disguise. Sansec documented a Rust implant posing as fc-cache, with a scheduled restart, and later a variant named chronyd. In one observation, the same agent identifier survived the change: the implant had renamed itself.
That second name resembles a legitimate Linux time service. The suspicious implementation also used UDP port 123, making its traffic look related to clock synchronization. A process name or port number is therefore a clue to investigate in context, not a safe exception to add to monitoring.
This explains the separation between patching and recovery. Correcting the template flaw stops that route into the application. It does not, by itself, establish that a previously launched process, scheduled restart or exposed secret has been removed. A merchant needs evidence about both the application and its host.
Adobe now has patches for more exact builds
The September 11 Adobe instructions expand hotfix compatibility across older 2.4.4–2.4.7 builds and list separate packages for older 2.4.8 releases. Use the current vendor table to match the complete installed version; a branch number alone is insufficient. For example, Adobe assigns 2.4.8-p2/p3 and 2.4.8/p1 to different patch packages.
Keep two vendor scopes distinct: the affected-product list and the broader hotfix-compatibility table are not identical. The published table does not establish coverage for every unsupported Magento release. If your build is absent, involve its maintainer or hosting provider instead of applying the nearest-looking package.
Adobe also documents an installation-status check specifically for Commerce on Cloud. An “Applied” result answers whether that hotfix is installed; it is not a forensic clearance of the store.
Credentials need a separate response. Adobe says changing Commerce’s encryption key does not revoke secrets someone may already have read. Its instructions cover passwords and integration tokens, payment-provider credentials and privileged server access. Replace affected credentials at the service that issued them, following the vendor’s maintenance and rotation sequence.
Close the entry, then account for what got through
For store operators, the useful handoff to a developer or responder is the exact build, hotfix status and evidence from the host—not simply “Magento is updated.” Earlier CosmicSting coverage concerns a different Adobe Commerce vulnerability. StyleSmuggler has its own entry chain, patch and investigation; neither an old fix nor a clean-looking storefront settles this case.
References
- Sansec Forensics Team. StyleSmuggler investigation. Published September 5, updated September 11, 2026; accessed September 12, 2026.
- Adobe. Critical security update for Adobe Commerce: APSB26-146. Experience League, updated September 11, 2026; accessed September 12, 2026.
