Adobe has pushed an out-of-band security update addressing CVE-2026-75650, a max-severity vulnerability in Magento and Adobe Commerce that has been exploited in the wild since at least September 4. The flaw, discovered by e-commerce security firm Sansec, allows attackers to inject PHP code through Magento's template system, leading to arbitrary code execution.
Attacks observed by Sansec have deployed a Rust-based backdoor disguised as a legitimate system process (initially as [kworker/u:8:0], later as fc-cache). The backdoor communicates with its command-and-control infrastructure using UDP packets to port 123, masking traffic as Network Time Protocol (NTP) traffic. Persistence is maintained via a cron job that repeats every 30 minutes. Sansec also reported that a second attacker using different tooling has exploited the same vulnerability to deploy a 485-byte PHP web shell that exfiltrates server data via Interactsh, an open-source security testing tool.
Affected versions include Adobe Commerce 2.4.4 through 2.4.9 (including August 2026 releases), Adobe Commerce B2B 1.3.3 through 1.5.3, and Magento Open Source 2.4.6 through 2.4.9. Adobe has assigned the update its highest priority rating and recommends immediate installation of the VULN-39341 hotfix. The vendor notes that the hotfix has only been tested against the August 2026 releases; compatibility with earlier releases is unconfirmed.
After applying the fix, administrators are advised to enable maintenance mode, suspend cron jobs, rotate all secrets (including admin passwords, API keys, and database credentials), flush the cache, restore cron execution, and disable maintenance mode. Sansec previously suggested disabling GraphQL as a temporary mitigation before the patch was available.
Indicators of compromise include an unexpected surge of "Payment Transaction Failed Reminder" emails, suspicious processes named kworker or fc-cache, and unusual cron entries or temporary files.