When we wrote about StyleSmuggler on 5 September, there was no CVE, no advisory and no patch - just Sansec's research showing a fully updated 2.4.6-p15 store had been hit through a GraphQL "styles" field abused to plant a Rust backdoor. That gap closed on 8 September, when Adobe shipped patch VULN-39341 alongside its regular September security bulletin and the flaw finally got a number: CVE-2026-75650, CVSS 10.0. The Hacker News' writeup confirms what we suspected at the time - this wasn't a template quirk, it was unauthenticated PHP code injection sitting inside Magento's own "Payment Transaction Failed Reminder" email template, reachable without a login.
Four days sounds fast. It wasn't fast enough
Adobe moving from confirmed exploitation to a shipped hotfix in four days is, by the standard of some of the vendors we've covered this year, genuinely quick. But Sansec's own research page pins the first confirmed attack to 4 September at 10:20pm UTC, and the store it was watching most closely was completely compromised - backdoor installed, persistence established - inside fifty minutes. A four-day patch timeline and a fifty-minute compromise timeline aren't measuring the same clock. One measures how fast a vendor can respond once it knows. The other measures how fast an attacker who already knows can finish the job on anyone who doesn't patch immediately.
Two payloads, not one
Sansec's telemetry shows attackers weren't just planting a single foothold. Compromised stores received a Rust-compiled Linux backdoor that phones home to an external command server, and separately a PHP dropper that installs a web shell capable of running arbitrary PHP - belt and braces, so that losing one persistence mechanism to a routine malware scan doesn't cost the attacker the store. That's a deliberate design choice, and it's the same reason Adobe's own remediation guidance goes well beyond "install the patch."
The patch fixes the hole. It doesn't undo what walked through it
Adobe's guidance is blunt about this: applying VULN-39341 stops new exploitation, but any store that was live and unpatched between 4 and 8 September should be treated as compromised until proven otherwise. That means rotating the Magento encryption key and, per Adobe's own list, every credential it protects - admin passwords, REST/SOAP/GraphQL integration tokens, OAuth client secrets, payment gateway API keys, database credentials, SSH and deploy keys, and any third-party extension API keys stored in the platform. It's a long list, and skipping items on it because "the patch is in" is exactly the mistake this vulnerability was built to punish.
Why we're still writing about this one
Most of the zero-days we cover get a patch and drop off the radar. This one's worth a second post because the four-day gap between confirmed exploitation and a fix is itself the story of 2026 so far: vendors are, on average, getting faster at responding to active exploitation, and attackers are getting faster at making that response matter less. Fifty minutes from first attack to full backdoor is not a number a patch cycle - any patch cycle - is built to beat.
- Apply Adobe's VULN-39341 patch now if you haven't already; CISA's federal deadline is 11 September, and that clock applies just as well to anyone else running Magento or Adobe Commerce.
- Treat any store that was live between 4 and 8 September as potentially compromised, regardless of whether you've noticed anything unusual - the Rust backdoor and PHP web shell are both built to stay quiet.
- Rotate the Magento encryption key and every credential Adobe lists against it: admin, integration tokens, OAuth secrets, payment gateway keys, database credentials, SSH/deploy keys and extension API keys.
- Scan for both payload types specifically - a clean scan for one doesn't mean the other isn't sitting there as a fallback.
- If your store runs on infrastructure you don't fully control, confirm with your hosting or platform provider that the patch has actually been applied rather than assuming it's covered.
A four-day patch is a reasonable response to a zero-day. It is not, on its own, a reason to skip the credential rotation - and if you'd like a second pair of eyes on whether your Magento estate came through this clean, email sales@halfteck.com.