160,000 Online Stores Were Hacked This Week, Even the Fully Patched Ones

A Perfectly Safe Store That Wasn't

Your store had the latest patches. You ran the July update. You ran the August update. You did everything right. And attackers still owned your server by September 5.

That is the brutal reality of CVE-2026-75650, nicknamed StyleSmuggler by Dutch security firm Sansec. It carries a CVSS score of 10.0, the maximum possible rating. Hackers began exploiting it on September 4, 2026, three days before Adobe even had a patch ready. No patch could have saved you that week, because the patch did not exist yet.

How Did Attackers Get In Without a Password?

They never needed one. StyleSmuggler abuses Magento's built-in email template engine, the same system that sends customers order confirmations and shipping notices. Attackers crafted a fake "Payment Transaction Failed Reminder" email template and used it to inject raw PHP code directly into the server. Magento processed it, executed it, and handed over full server control. No login. No brute force. No phishing link for an employee to click. Just a malformed template that the software trusted completely.

Once inside, the attackers did not stop at a quick smash-and-grab. They deployed two tools designed for long-term, silent occupation. The first was a Rust-based Linux backdoor, a persistent implant that survives reboots and hides cleanly from basic monitoring. The second was a PHP web shell that lets them run arbitrary commands on your server whenever they want, from anywhere in the world. Think of it as a hidden remote desktop for criminals, sitting quietly on your infrastructure until they decide to use it.

Every store version from Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9 was vulnerable. If you run Magento, you were in the blast radius.

How Many Stores Are We Talking About?

Between 160,000 and 239,000 stores worldwide run Magento or Adobe Commerce. Every one of them was exposed. Attackers had a three-day head start before any fix existed, and the window stayed open for anyone who did not apply Adobe's emergency patch APSB26-146 the moment it dropped on September 7.

CISA added StyleSmuggler to its Known Exploited Vulnerabilities catalog on September 8. That catalog is reserved for flaws confirmed to be actively exploited in the wild. Federal agencies now face a mandatory patch deadline of September 11. The US government does not issue those orders for theoretical threats.

If you are a shopper: if you bought anything from a small or mid-sized online store this week, your payment card number, billing address, and order history may have passed through a compromised server. You have no way to know which stores were hit and which were not. That is the honest answer.

What You Need to Do Right Now

If you run a Magento or Adobe Commerce store:

1. Apply patch APSB26-146 immediately. Find it through Adobe's official security bulletins. Do not wait for a scheduled maintenance window.
2. Audit your email templates right now. Look for any unfamiliar templates, especially anything referencing payment failures or transaction reminders you did not create.
3. Search your server for new or recently modified PHP files. Attackers often drop web shells with innocuous-looking names in your web root or cache directories.
4. Check running processes for anything unexpected. A Rust binary that appeared after September 4 is a red flag.
5. Rotate every credential that touched this server. Database passwords, admin accounts, API keys, payment gateway credentials. All of them.
6. Tell your customers. Transparency is not just ethical, it is legally required in most jurisdictions if payment data was exposed. Get ahead of it.
7. Hire an incident response firm if you have any doubt about your server's current state. A compromised store that looks clean is still compromised.

If you are a shopper who bought from a smaller online store this week:

1. Monitor your payment card for unfamiliar charges. Contact your bank immediately if you see anything suspicious.
2. Request a new card number from your bank. Most will issue one without closing your account.
3. Place a credit freeze with all three major bureaus, Equifax, Experian, and TransUnion. It is free, it takes minutes, and it blocks anyone from opening new credit in your name.
4. Enable two-factor authentication on any account linked to that email address or payment method.

The Uncomfortable Truth About "Fully Patched"

What happened this week breaks one of the foundational beliefs in online security: that keeping your software up to date protects you. It does, most of the time. But zero-day vulnerabilities, flaws exploited before any patch exists, shatter that assumption completely.

StyleSmuggler exposed something most store owners never think about. Running commercial e-commerce software means inheriting the attack surface of every feature that software contains, including obscure internal systems like email template engines that most store owners have never opened. You do not need to understand every line of code in your platform. You do need to know that skilled attackers do.

The gap between "Adobe ships a patch" and "the flaw gets exploited" is now often measured in hours, not weeks. Attackers scan the internet continuously. When a critical vulnerability drops, automated tools find and compromise vulnerable servers faster than any human IT team can respond. A CVSS 10.0 rating means every attacker in the world treats it as a priority target.

Security is not a state you achieve. It is a practice you maintain.

Do this now:

• Store owners: patch APSB26-146 today, audit templates, rotate all credentials
• Shoppers: monitor your card, request a new number, freeze your credit at all three bureaus
• Everyone: turn on two-factor authentication on your email and any account tied to your payment info

Sources

• thehackernews.com
• bleepingcomputer.com