Affected Systems
All versions of Magento and Adobe Commerce, including latest patched versions. Affects approximately 160,000 websites globally, including 14,000 in the top 1 million sites.
Exploitation Status
Active exploitation confirmed since September 4, 2026. Attackers deploying Rust-based Linux backdoor via PHP code injection in Magento's template system. No patch available as of September 7, 2026.
Business Impact
Critical risk for all Magento/Adobe Commerce deployments. Attackers gain persistent backdoor access via cron jobs, with C2 communication disguised as NTP traffic to evade detection. Backdoor enables remote command execution. Adobe confirmed working on fix but provided no timeline; next scheduled security release is September 8, 2026.
Urgency
🔴 Immediate
Recommended Actions
- Disable GraphQL on all Magento and Adobe Commerce instances immediately as temporary mitigation
- Monitor for unexpected 'Payment Transaction Failed Reminder' email surges from Magento systems
- Hunt for suspicious processes named 'kworker/u:8:0' or 'fc-cache' in ~/.cache/fontconfig/ and review cron jobs for unauthorized entries repeating every 30 minutes
- Inspect firewall logs for unusual UDP traffic to port 123 (NTP) from web servers, especially to non-standard time server hostnames
- Rotate all Magento administrative and database credentials if compromise is suspected
- Apply Adobe security patch immediately when released (expected September 8, 2026)