Beyond the Patch: Evicting CosmicSting (CVE-2024-34102) Backdoors, and Why StyleSmuggler (CVE-2026-75650) Is a Separate Zero-Day

Correction (2026-10-07): An earlier version of this article described StyleSmuggler as a CSS-hidden payment skimmer that persists after CosmicSting (CVE-2024-34102, APSB24-40) is patched. That was wrong. Per Sansec's research, StyleSmuggler is a separate, unauthenticated remote-code-execution zero-day, CVE-2026-75650 (CVSS 10.0), fixed by Adobe in APSB26-146. It has no link to CosmicSting in Sansec's write-up. The CSS-hiding technique, loader code and CSS-specific detection advice we described are not supported by any source and have been removed. The CosmicSting material below is unchanged in substance.

CosmicSting (CVE-2024-34102, Adobe bulletin APSB24-40) was exploited in the wild and is on CISA's Known Exploited Vulnerabilities list. On Magento Open Source and Adobe Commerce stores it let attackers read app/etc/env.php, steal the encryption key (crypt.key) and forge administrative tokens, so applying Adobe's fix does not by itself remove the admin accounts, web shells or injected content already left behind. A second, unrelated zero-day, StyleSmuggler (CVE-2026-75650), hit the same platforms in September 2026 and is covered separately below.

Merchants who patch without executing forensic remediation remain actively compromised. The same patch-isn't-enough lesson applies to Palo Alto Expedition's critical takeover flaws. Dislodging these intrusions means rotating stolen secrets and auditing the store for persistence, whichever flaw was used to get in.

Technical Profile: The CosmicSting Ingress Vector

The server-side flaw behind many Magento and Adobe Commerce compromises is CVE-2024-34102, widely tracked as CosmicSting. Disclosed under security advisory APSB24-40, this vulnerability carries a critical severity rating of CVSS 9.8.

CosmicSting stems from unsafe XML parsing within the Magento WebAPI framework. Remote, unauthenticated attackers send crafted XML payloads containing external entity declarations to public REST or SOAP endpoints, forcing the underlying XML parser to return local file contents.

The primary target is app/etc/env.php, the core configuration file storing database credentials, cache settings, and the platform encryption key (crypt.key). In Magento architectures, crypt.key signs and validates administrative JSON Web Tokens (JWT) used across REST APIs.

Once actors exfiltrate crypt.key, they forge valid administrative JWTs offline. This completely bypasses administrative passwords and two-factor authentication (2FA). Arbitrary file-read bugs keep producing this, as in GitLab's unauthenticated file read exposing secrets. With forged tokens, attackers invoke /rest/V1/* endpoints to provision rogue administrator accounts, alter CMS layout blocks, and plant web shells.

StyleSmuggler (CVE-2026-75650): A Separate Zero-Day

StyleSmuggler is not a post-CosmicSting skimmer. Sansec, which found it, describes an unauthenticated remote-code-execution zero-day in Magento Open Source and Adobe Commerce, CVE-2026-75650, scored CVSS 10.0. Adobe tracks it as APSB26-146 (priority 1, published 7 September 2026) and states that it "is aware of CVE-2026-75650 being exploited in the wild".

Sansec describes two stages: attackers inject PHP code (for example by generating a failure report), then Magento executes it when it renders a failed-payment reminder email. Nobody has to open the email, and a burst of unexpected "Payment Transaction Failed Reminder" messages is a reason to investigate, though genuine declined payments send the same email.

A patched store is still exposed. Sansec's first victim ran 2.4.6-p15 with the July and August 2026 patches applied, and Sansec blocked a probe against a 2.4.7-p10 store on 7 September, so "the current patch level is no defence". Only the hotfix fixes this. It ships as a composer patch, VULN-39341-composer-patches.zip from repo.magento.com, not as a new release. Confirm it is installed with:

vendor/bin/magento-patches -n status | grep "39341\|Status"

Adobe tested the hotfix against the August 2026 releases; older versions in those branches are affected but the patch is unverified there. Adobe publishes nothing for 2.2, 2.3 or 2.4.0 to 2.4.3, and the third-party agency Scandiweb has backported the fix to older releases, which Sansec has not reviewed.

Patching closes the hole but does not clean a store that was already hit. Adobe recommends rotating the encryption key and every credential it protected, and Sansec adds that rotating the key on its own does not invalidate anything an attacker already read. Sansec reports background processes disguised as [kworker/u:8:0], fc-cache, chronyd or gvfsd-user. Persistence varies: one chronyd build "can relaunch itself with no cron entry at all, so an empty crontab is not evidence that a host is clean", while other builds wrote a cron entry straight into the spool file, so check the spool file itself, not just crontab -l. Each stage-2 attempt leaves a Laminas\Loader\Exception\InvalidArgumentException line in var/log/exception.log.

Sansec also saw a second, unrelated attacker come in through StyleSmuggler and drop a PHP web shell at pub/media/catalog/product/cache/ss_<10hex>/sync_<10hex>.php. Its check for stray PHP in the media directory is:

find -L pub/media -type f -name '*.php'

On one compromised store Sansec also found a base64 skimmer stored in core_config_data under design/head/includes, which query 2 below covers. Sansec keeps updating its indicator list, so read it in full: https://sansec.io/research/stylesmuggler-0day

Why Patching Is Not Enough

Both incidents share one lesson: closing the entry point does not remove what an attacker left behind.

• Stolen secrets outlive the patch. With CosmicSting, a copied crypt.key still forges admin tokens after the XXE flaw is fixed until the key is rotated.
• Persistence survives code updates. Sansec reports that StyleSmuggler implants keep running after the hotfix is applied, so removing the process and any dropped PHP files is a separate step from patching.
• Cached assets can linger. If a store's pages or static files were modified, CDN and browser caches may keep serving the altered files until purged.

Forensic Triage Playbook

Incident responders auditing a Magento environment after CosmicSting (APSB24-40) or StyleSmuggler (APSB26-146) must inspect both the database and the filesystem for unauthorized modifications.

Consolidated Database Audit

Execute the following queries to identify unauthorized administrative accounts, malicious configuration scripts, and compromised CMS content:

-- 1. Identify newly provisioned or anomalous administrative users
SELECT user_id, username, email, created, modified, is_active
FROM admin_user
ORDER BY user_id DESC LIMIT 20;

-- 2. Audit core configuration paths and global header/footer injections
SELECT scope, scope_id, path, value, updated_at
FROM core_config_data
WHERE path IN ('design/head/includes', 'design/footer/absolute_footer')
 OR value LIKE '%<script%' OR value LIKE '%atob(%' OR value LIKE '%eval(%';

-- 3. Audit CMS blocks and pages for hidden loaders
SELECT 'cms_block' AS source_table, block_id AS id, identifier, update_time, content
FROM cms_block
WHERE content REGEXP '(<script|atob|eval|base64)'
UNION ALL
SELECT 'cms_page' AS source_table, page_id AS id, identifier, update_time, content
FROM cms_page
WHERE content REGEXP '(<script|atob|eval|base64)'
 OR custom_layout_update_xml IS NOT NULL;

Streamlined Filesystem Audit

Run targeted scans across static assets, source themes, and writable upload paths to identify dropped web shells:

# Hunt for PHP shells and dynamic evaluation wrappers in public upload directories
find pub/media/ pub/static/ -type f \( -name "*.php*" -o -name "*.phar" \)
grep -rnE '(eval\(|base64_decode\(|assert\(|passthru\(|shell_exec\()' pub/media/

Post-Breach Remediation: PCI-DSS 4.0 Containment Protocol

Remediation requires complete cryptographic rotation, asset rebuilding, and the enforcement of PCI-DSS v4.0 requirements. For StyleSmuggler, Sansec and Adobe also advise rotating the encryption key and every credential it protected.

+-----------------------------------------------------------------------------------+
| PCI-DSS 4.0 CLIENT-SIDE DEFENSE ARCHITECTURE |
+-----------------------------------------------------------------------------------+
 Requirement 6.4.3: Script Authorization & Integrity
 ├── Content Security Policy (CSP): Disallow 'unsafe-eval' to break base64 loaders
 └── Subresource Integrity (SRI): Cryptographic hash validation on all stylesheets

 Requirement 11.6.1: Tamper Detection
 ├── Real-Time Monitoring: Detect unauthorized modifications to checkout headers
 └── DOM Integrity Checks: Alert on unapproved script or stylesheet injections

Step 1: Rotate Master Secrets and Invalidate Sessions

Because CosmicSting enables arbitrary file reads, assume crypt.key has been exfiltrated (and for a StyleSmuggler compromise, assume the same):

1. Rotate the Cryptographic Key: Run the built-in CLI tool to generate a new key and re-encrypt stored payment secrets:

bin/magento encryption:key:change

2. Purge Admin Sessions and Tokens: Invalidate all active tokens and sessions to terminate unauthorized access:

DELETE FROM oauth_token;
DELETE FROM oauth_token_request_log;

3. Rotate Ancillary Credentials: Update database passwords, external payment gateway API keys, and internal webhook secrets.

Step 2: Purge Static Assets and Invalidate Edge Caches

1. Wipe and Redeploy Generated Content:

rm -rf pub/static/frontend/* pub/static/adminhtml/* var/view_preprocessed/*
git reset --hard origin/main
bin/magento setup:static-content:deploy -f
bin/magento cache:flush

2. Purge CDN and Bust Client Caches: Dispatch a global purge across edge CDN nodes. Increment the static deploy version via bin/magento setup:upgrade --keep-generated to force returning browsers to request fresh assets instead of loading altered files from local disk caches.

Step 3: Implement PCI-DSS 4.0 Defenses

• Requirement 6.4.3 (Script Authorization and Integrity): Deploy a strict Content Security Policy (CSP) header across checkout routes:

Content-Security-Policy: default-src 'self'; script-src 'self' https://js.stripe.com; style-src 'self'; connect-src 'self' https://api.stripe.com; object-src 'none';

Excluding 'unsafe-eval' blocks loaders that decode and run payloads with eval() or new Function(). Implement Subresource Integrity (SRI) hashes on script and stylesheet tags so browsers reject tampered files. These are client-side hardening measures; they do not fix either server-side flaw.

• Requirement 11.6.1 (Tamper Detection): Deploy automated change-detection mechanisms to alert security personnel whenever checkout HTTP headers or page scripts are altered.

Pairing immediate server-side secret rotation with client-side execution boundaries reduces the chance of attacker persistence and protects cardholder data.

Sources

• Sansec: StyleSmuggler, Magento and Adobe Commerce 0-day RCE (CVE-2026-75650)
• CISA Known Exploited Vulnerabilities catalogue (CVE-2024-34102 added 2024-07-17; CVE-2026-75650 added 2026-09-08)
• NVD: CVE-2024-34102
• Adobe APSB24-40 and APSB26-146 (archived copies; Adobe's live pages block automated fetches)

Related reading

• Critical SAML Signature Wrapping Flaw Exposes GitHub Enterprise Server to Unauthenticated Admin Takeover
• Adobe Commerce and Magento CVE-2026-71362: KEV authorization flaw