EN PT-BR
← Voltar ao feed
critical e-commerce

StyleSmuggler (CVE-2026-75650) in Magento/Adobe Commerce exploited to deploy PSK Agent RAT and PHP webshell

1 fonte(s) · 1 atualização(ões) · publicado 03/11/2026 05:42 · coletado há 2 horas

Attackers exploited the critical StyleSmuggler flaw (CVE-2026-75650) in Magento and Adobe Commerce between September 9 and 13, 2026. According to Imperva, whose earlier analysis reports a CVSS score of 10.0 and exploitation preceding Adobe's emergency hotfix, the flaw allows unauthenticated remote code execution through Magento's template processing. The attackers used it to deploy the PSK Agent remote access trojan. Stores in Western Europe, North America and Asia-Pacific were targeted. Researchers identified five attack clusters using near-identical PHP payloads, and a recurring delivery URL that appeared 96 times across 12 variants points to standardized exploitation. Chinese-language comments and infrastructure naming suggest a Chinese-speaking operator (moderate confidence), but this does not establish attribution to any named group. PSK Agent differs from the Rust backdoor in earlier StyleSmuggler research, which indicates multiple operators using the same entry point.

Entenda a falha

A vulnerabilidade

CVE-2026-75650, called StyleSmuggler, is a critical flaw in Magento and Adobe Commerce. Imperva says it allows unauthenticated remote code execution through Magento's template processing, and its earlier analysis reports a CVSS score of 10.0. The attacker only needs network access to the store, with no login or user interaction, and gets code execution on the server. The articles give no affected version ranges. The fix is Adobe's VULN-39341 hotfix, and exploitation began before Adobe issued that emergency hotfix.

Como funciona

The attacker first sends a request to the /paypal/transparent/response/ endpoint with PHP code in the query string. Magento records that request in a failure report under var/report/, and some variants target writable application logs instead. A second request to /graphql then passes attacker-controlled styles parameters. Magento loads the poisoned report through its template processing and the embedded PHP runs on the server.

Por que é vulnerável

The articles do not state the root cause in code terms. What they describe is that attacker-controlled styles parameters make Magento's template processing load a file that contains attacker-written content, a failure report or log written from a request. In effect, untrusted data stored on disk ends up being treated as executable PHP. The articles do not explain what the hotfix changes or why the flaw went unnoticed.

Onde está

The articles name the /paypal/transparent/response/ endpoint, the /graphql endpoint with its styles parameters, and the var/report/ directory, but no file, function or fixing commit.

Como foi descoberta

Imperva researchers analyzed the flaw; their earlier analysis reported a CVSS score of 10.0 and exploitation before Adobe's emergency hotfix. The new reporting covers attacks observed between September 9 and 13, 2026, against stores in Western Europe, North America and Asia-Pacific. Researchers grouped them into five clusters with near-identical payloads. PSK Agent differs from the Rust backdoor in earlier StyleSmuggler research, which suggests multiple operators using the same entry point. The articles do not say how the flaw was first found or reported to Adobe.

Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 06:17.

Detalhes técnicos

  • Attackers place PHP code in the query string of /paypal/transparent/response/. Magento writes the request to a failure report under var/report/. A follow-up /graphql request abuses attacker-controlled styles parameters to load the poisoned report and execute the embedded PHP. Variants also target writable application logs.
  • The payload cycles through shell_exec, system, exec and sometimes passthru to work around disabled PHP functions. It then pipes the dropper from curl into bash.
  • psk_agent.sh (3,313 bytes) looks for writable, executable locations in $HOME, /tmp, /var/tmp and /dev/shm. It downloads via curl, wget, Python 2 or Python 3, and launches the next stage with setsid or nohup.
  • The next stage, chi_down, is a 10.5 MB obfuscated 64-bit Go binary with stripped build information. It provides shell command execution, host reconnaissance, SOCKS5 proxying, and HTTP/HTTPS/encrypted communications. Launch arguments -checkagent=false and -maintain=true, plus scheduling and persistence artifacts, indicate an effort to keep access.
  • The dropper reportedly had zero VirusTotal detections at analysis time, which does not reflect current coverage.
  • Some payloads embed the victim hostname in subdomains of 0f851bdc9d[.]ddns[.]1433[.]eu[.]org, so attacker-controlled DNS can confirm execution even when HTTP callbacks fail.
  • Other attacks fetch t4.php and save it as zer4.php in directories such as pub/media/. This 910-line webshell offers file management, PHP evaluation and OS commands. It uses PHP FFI to call libc directly, and its commands are encrypted with AES-256-CBC under a shared hardcoded key.
  • Most traffic came from four source IPs. Their geography is consistent with rented or compromised infrastructure and is not reliable evidence of the operator's location.

Remediação

  • Apply Adobe's VULN-39341 hotfix. Patching alone is not eradication, so investigate exposed servers.
  • Check for unexpected PHP files, chi_down, cron and systemd persistence, suspicious DNS queries, and outbound connections from web-server processes.
  • If compromise is confirmed, remove persistence and rotate accessible credentials, Magento encryption keys, integration tokens and payment-gateway secrets.

Linha do tempo

  1. gbhackers.com ↗ · pub. 03/11/2026 05:42 · coletado 03/11 06:00 primeiro registro

    StyleSmuggler (CVE-2026-75650) in Magento/Adobe Commerce exploited to deploy PSK Agent RAT and PHP webshell

    ler a análise desta fonte

    Attackers exploited the critical StyleSmuggler flaw (CVE-2026-75650) in Magento and Adobe Commerce between September 9 and 13, 2026. According to Imperva, whose earlier analysis reports a CVSS score of 10.0 and exploitation preceding Adobe's emergency hotfix, the flaw allows unauthenticated remote code execution through Magento's template processing. The attackers used it to deploy the PSK Agent remote access trojan. Stores in Western Europe, North America and Asia-Pacific were targeted. Researchers identified five attack clusters using near-identical PHP payloads, and a recurring delivery URL that appeared 96 times across 12 variants points to standardized exploitation. Chinese-language comments and infrastructure naming suggest a Chinese-speaking operator (moderate confidence), but this does not establish attribution to any named group. PSK Agent differs from the Rust backdoor in earlier StyleSmuggler research, which indicates multiple operators using the same entry point.

    Technical Details

    • Attackers place PHP code in the query string of /paypal/transparent/response/. Magento writes the request to a failure report under var/report/. A follow-up /graphql request abuses attacker-controlled styles parameters to load the poisoned report and execute the embedded PHP. Variants also target writable application logs.
    • The payload cycles through shell_exec, system, exec and sometimes passthru to work around disabled PHP functions. It then pipes the dropper from curl into bash.
    • psk_agent.sh (3,313 bytes) looks for writable, executable locations in $HOME, /tmp, /var/tmp and /dev/shm. It downloads via curl, wget, Python 2 or Python 3, and launches the next stage with setsid or nohup.
    • The next stage, chi_down, is a 10.5 MB obfuscated 64-bit Go binary with stripped build information. It provides shell command execution, host reconnaissance, SOCKS5 proxying, and HTTP/HTTPS/encrypted communications. Launch arguments -checkagent=false and -maintain=true, plus scheduling and persistence artifacts, indicate an effort to keep access.
    • The dropper reportedly had zero VirusTotal detections at analysis time, which does not reflect current coverage.
    • Some payloads embed the victim hostname in subdomains of 0f851bdc9d[.]ddns[.]1433[.]eu[.]org, so attacker-controlled DNS can confirm execution even when HTTP callbacks fail.
    • Other attacks fetch t4.php and save it as zer4.php in directories such as pub/media/. This 910-line webshell offers file management, PHP evaluation and OS commands. It uses PHP FFI to call libc directly, and its commands are encrypted with AES-256-CBC under a shared hardcoded key.
    • Most traffic came from four source IPs. Their geography is consistent with rented or compromised infrastructure and is not reliable evidence of the operator's location.

    Remediation

    • Apply Adobe's VULN-39341 hotfix. Patching alone is not eradication, so investigate exposed servers.
    • Check for unexpected PHP files, chi_down, cron and systemd persistence, suspicious DNS queries, and outbound connections from web-server processes.
    • If compromise is confirmed, remove persistence and rotate accessible credentials, Magento encryption keys, integration tokens and payment-gateway secrets.