Nine 48-byte datagrams, spaced 10 milliseconds apart, arrive every 60 seconds. To a standard network monitor, this looks like routine NTP traffic. To the Rust-based implant behind CVE-2026-75650, it is a heartbeat. This is StyleSmuggler, a critical vulnerability in Adobe Commerce and Magento 2.4.4 through 2.4.9 that has turned the platform’s own template-processing logic into an unauthenticated remote-code-execution chain.
The mechanics are precise. An attacker injects PHP code into system style properties via the template system. The payload does not require a user to open an email; it executes automatically when the application renders a Payment Transaction Failed Reminder. As Disrex noted, “StyleSmuggler turns Magento’s own template-processing and dependency-injection code into an unauthenticated remote-code-execution chain.” Sansec confirmed this chain on clean installations of Magento Open Source 2.4.7, 2.4.8, and 2.4.9. Adobe issued APSB26-146 and hotfix VULN-39341 on September 7. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on September 8, with a federal remediation deadline of September 11.
Once the initial injection succeeds, a 1.9MB statically linked Rust binary is deployed. To evade detection, the implant masquerades as system processes like kworker, fc-cache, or chronyd. The choice of name is tactical; administrators filtering UDP port 123 traffic are likely to exclude chronyd as a legitimate time daemon. Two things separate the implant from a real NTP client: it emits nine 48-byte datagrams about 10 milliseconds apart every 60 seconds, where a real client sends one, and every datagram is marked NTPv4 server mode, which a client has no reason to send. The implant also monitors /proc/self/status for signs of debugging. If it detects it is being traced, it remains dormant, refusing to beacon.
Simultaneously, a separate attacker group has been observed dropping a 485-byte PHP web shell into the product image cache. Multiple distinct operators on the same victim stores is not unusual for a zero-day at this severity level; what is unusual is the speed. Disrex observed the first compromised store hit 50 minutes after the initial confirmed exploitation on September 4.
This vulnerability is the latest in a recurring pattern that has compromised systems from PaperCut and N-able through Microsoft, SAP, and DeepSeek Harness. The authentication gap persists because the security controls intended to validate session integrity are evaluated too late in the execution flow to prevent the initial compromise. StyleSmuggler is the fourth Adobe Commerce CVE added to the CISA KEV catalog since 2022, following CVE-2022-24086, CosmicSting (CVE-2024-34102), and SessionReaper (CVE-2025-54236).
The impact on merchant payment infrastructure is immediate. Moving sessions to Redis or the database provides no protection against this injection. The attacker is not just stealing data; they are establishing persistent control over the transaction environment through a backdoor that survives reboots, rotates its own process name, and communicates through traffic that passes most egress filtering unremarked.
Patching closes the injection vector. It does nothing to remove existing backdoors or web shells. As Sansec warned: “Rotate those at the source, not only inside Magento. Rotating the encryption key on its own does not invalidate anything an attacker already read.” Stores active during the three-day window before the hotfix require full incident response, including credential rotation at the source—payment gateway keys, SSH access, database credentials—not internal Magento resets alone.