Last updated 8 September 2026. This story is moving quickly and this article will be updated as Adobe and Sansec publish more.
The first confirmed victim of last week’s Magento attacks was fully patched: version 2.4.6-p15 with the July and August 2026 security updates applied. That is the fact to sit with, because it removes the usual comfort. This was not a story about neglected websites. From 4 September, attackers were using a flaw that existed in every current version of Magento and Adobe Commerce, including the newest release, and for three days there was nothing for even the most careful store owner to install. Adobe’s fix arrived on the evening of 7 September. If you run a Magento or Adobe Commerce store, applying it is today’s job, and this article explains what else needs checking.
What happened
On 5 September, the Dutch ecommerce security firm Sansec disclosed a vulnerability it calls StyleSmuggler, with live attacks observed from the day before.[1] It allows unauthenticated remote code execution, which in plain terms means somebody who has never had an account on your store can run their own code on your server. No login, no password, no help from you or your staff.
The attack works in two stages: first the malicious code is smuggled into the store’s template system, hidden inside styling properties, and then it is triggered later when the store renders it.[1] We are deliberately not describing the mechanics beyond that, and the technical detail is in Sansec’s write-up for those who want it. What matters for a store owner is the outcome: attackers have been using it to plant web shells and backdoors, giving themselves a way back in that survives any later clean-up of the original hole.[1][2]
Sansec reproduced the full attack on clean installations of Magento Open Source 2.4.7, 2.4.8 and 2.4.9, and Adobe’s advisory covers versions 2.4.4 through 2.4.9 across Magento Open Source, Adobe Commerce and the B2B extension.[1][3] In practice, if your store runs on Magento, you should assume it was affected.
The fix arrived on 7 September, and it is not a normal update
For three days there was no patch. Adobe published its advisory, APSB26-146, on the evening of 7 September, assigning CVE-2026-75650 with a severity of 10.0 out of 10 and its highest priority rating.[3] Two things about the fix are worth understanding.
First, it ships as a hotfix rather than as a new Magento release: a small patch, VULN-39341, applied through Composer, the tool developers use to manage a store’s code.[2][3] There is no button in the admin panel for this. If a developer or an agency looks after your store, send them the advisory today and ask them to confirm when it is applied. If nobody looks after your store, that is the gap this week has exposed, and your host should be your first call.
Second, patching closes the door for the future. It does nothing about anyone who came through it between 4 September and the moment the patch lands. Sansec also recommends rotating the store’s encryption keys and stored credentials after patching, because a compromised store cannot assume its secrets are still secret.[1]
What to do today
- Apply the hotfix. Advisory APSB26-146, patch VULN-39341, applied via Composer. If that sentence is not meaningful to you, forward it to whoever maintains your store, today.
- Rotate your encryption keys and credentials after patching, as Sansec advises.[1]
- Check for administrator accounts you cannot name. An account you did not create is a finding, not a mystery.
- Look for PHP files where they do not belong, particularly in media and upload directories, and for files modified since 4 September that nobody modified. Sansec’s write-up lists indicators a technical person can check safely.[1]
- Review recent orders and your checkout for the usual signs of card skimming, and take any customer report of odd payment behaviour seriously this week.
- Confirm you hold a backup from before 4 September, and that someone has actually restored one recently. A backup nobody has ever restored is a hope, not a plan.
- Ask your host what it did during the three days without a patch. The useful answer names specific controls and dates. “We take security seriously” is not an answer.
If your store was already compromised
A store that was backdoored on 4 September looks completely normal today. That is the point of a backdoor. If you find one, or find any of the signs above, resist the urge to simply delete what you found and move on. The attackers’ way back in is rarely the thing you noticed, and restoring a backup without understanding the entry point often just reinstates the backdoor along with everything else. The honest sequence is: patch, rotate every credential, find the entry point, check for extra accounts and scheduled tasks, then clean or restore, in that order. This is a job for somebody who has done it before. If that is not you, that is nothing to be embarrassed about, and it is exactly what your host or your agency should be for.
What the hosting layer was for this week
Most weeks, security advice ends with “update your software”, and most weeks that is correct. This week the update did not exist. What stood between stores and the attacks for those three days lived entirely at the infrastructure layer: web application firewall rules written against the observed attack pattern, file integrity monitoring that notices a new PHP file the moment it appears, monitoring of what a server talks to on the way out, write restrictions on directories that should never receive code, and daily backups with a restore that is known to work.
On Lucid Cloud Platform, that layer was already in place. Our platform runs active exploit and malware scanning across the stores we host, built to catch exactly this class of attack: code arriving where no code should be. Throughout the window between the first attacks on 4 September and Adobe’s fix, those scans found no compromised stores, so no customer needed to hear from us. If that had been different, the affected owners would have heard from us directly, and before anyone else.
If you are not sure where your store stands, we will run a free Magento security check this week: firewall rule status, a file integrity review, a search for unexpected administrator accounts, and verification that your backups restore. It is worth having even if you host elsewhere and change nothing, because the checklist above is the same one we will use.
Some weeks the update button is the answer. Last week it was not, and the layers underneath the application were the only thing standing there. That is what managed hosting is for, on the weeks when it matters.
Related reading
- Your contact form is a file upload. Two of them broke this month.
- WordPress backups and recovery: getting it right
Sources
- StyleSmuggler: Magento and Adobe Commerce 0-day RCE (CVE-2026-75650) under active attack, Sansec, 5 September 2026, updated 7 September 2026.
- Unpatched Magento and Adobe Commerce Zero-Day Exploited to Backdoor Online Stores, The Hacker News, September 2026.
- Adobe Commerce security bulletin APSB26-146, Adobe, 7 September 2026.
