[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fpL4sMYcXSTnTphlJl0EE0WGdFa9RsbvDLtS80mmi0Bw":3},{"article":4,"iocs":48,"watch_terms":63,"solutions":64,"lesson":130},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"d76a2771-a2cb-46e7-9cb9-a610912813a5","Hackers Exploit Adobe Commerce Zero-Day to Deploy PSK Agent RAT and Remotely Control Servers","hackers-exploit-adobe-commerce-zero-day-to-deploy-psk-agent-rat-and-remotely-con-24cb93","Attackers are abusing a serious flaw in Adobe Commerce and Magento to install a hidden remote access tool called PSK Agent on online store servers. Once it is running, they can run commands, route traffic through the server, and keep access even after a restart. The flaw, named StyleSmuggler and tracked as CVE-2026-75650, was first […] The post Hackers Exploit Adobe Commerce Zero-Day to Deploy PSK Agent RAT and Remotely Control Servers appeared first on Cyber Security News.","Attackers are exploiting a critical zero-day vulnerability in Adobe Commerce and Magento, tracked as CVE-2026-75650 (StyleSmuggler), to deploy the PSK Agent remote access tool. This RAT allows attackers to execute commands, proxy traffic, and maintain persistence on compromised online store servers. Multiple threat groups have been observed leveraging this flaw, with PSK Agent showing a 0% detection rate on VirusTotal at the time of analysis.","Adobe Commerce zero-day (CVE-2026-75650) exploited to deploy PSK Agent RAT.","https:\u002F\u002Fcybersecuritynews.com\u002Fadobe-commerce-zero-day\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Exploit-Adobe-Commerce-Zero-Day-to-Deploy-PSK-Agent-RAT-and-Remotely-Control-Servers.webp","2026-11-03T10:03:57+00:00","2026-11-03T11:00:24.112058+00:00",9,[17,20,22],{"name":18,"type":19},"Adobe Commerce","product",{"name":21,"type":19},"Magento",{"name":23,"type":24},"Go","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53,57,60],{"type":50,"value":51,"context":52},"cve","CVE-2026-75650","Adobe Commerce zero-day vulnerability",{"type":54,"value":55,"context":56},"domain","0f851bdc9d.ddns.1433.eu.org","DNS beaconing domain used by PSK Agent",{"type":42,"value":58,"context":59},"PSK Agent","Remote Access Trojan deployed via exploit",{"type":42,"value":61,"context":62},"chi_down","Obfuscated Go program, second stage of PSK Agent",[18,21],{"controls":65,"vendors":123},[66,94],{"slug":67,"name":68,"problem":69,"products":70},"patch-management","Automated patch management","Known holes get closed in days, not months.",[71,78,86],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":67,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",[124],{"slug":125,"name":126,"logo_path":127,"roles":128},"imperva","Imperva","\u002Fvendor-logos\u002Fimperva.png",[129],"reported_by",{"slug":131,"title":132,"body":133,"framework_refs":134,"framework_notes":142},"adobe-commerce-zero-day-exploited-to-install-psk-agent-rat-on-e-commerce-servers","Adobe Commerce Zero-Day Exploited to Install PSK Agent RAT on E-Commerce Servers","Attackers leveraged CVE-2026-75650 (StyleSmuggler), a critical zero-day in Adobe Commerce and Magento, to deploy the PSK Agent remote access tool before any patch was available, highlighting the acute danger of unmitigated vulnerabilities in internet-facing e-commerce platforms. The RAT grants full remote control, command execution, and traffic proxying, meaning compromised stores risk customer data theft, payment fraud, and prolonged attacker persistence. A 0% VirusTotal detection rate at time of analysis underscores how traditional signature-based defenses fail against novel malware, making layered detection strategies essential. The involvement of multiple threat groups signals that zero-day intelligence was shared or independently discovered rapidly, compressing the window between disclosure and mass exploitation to near zero.",[135,136,137,138,139,140,141],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","OWASP A06:2021 Vulnerable and Outdated Components","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","PCI DSS Requirement 6","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":143,"PCI DSS Requirement 6":144,"MITRE ATT&CK T1566: Phishing":145,"NIST SP 800-53 SI-2: Flaw Remediation":146,"OWASP A06:2021 Vulnerable and Outdated Components":147,"CIS Control 7: Continuous Vulnerability Management":148,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":149},"NIS2 requires essential and important entities to implement measures for incident handling and vulnerability management; operators of significant e-commerce platforms must have rapid-response procedures for zero-day exploitation, as mandated by this article.","PCI DSS Requirement 6 mandates that merchants develop and maintain secure systems, including prompt patching of known vulnerabilities on systems that store, process, or transmit cardholder data — directly applicable to Magento\u002FAdobe Commerce deployments.","While the initial vector here is web exploitation rather than phishing, PSK Agent's persistence and remote-access capabilities map to multiple ATT&CK techniques; using the ATT&CK framework to model adversary behaviour would have guided detection engineering for RAT persistence and C2 traffic.","SI-2 requires organisations to identify, report, and remediate information system flaws within defined timeframes; a mature flaw remediation process would have prioritised emergency mitigations for this zero-day affecting internet-facing commerce servers.","Adobe Commerce is an externally managed component; OWASP A06 directly calls for continuous monitoring of component vulnerabilities and rapid upgrading, which would have prompted immediate action upon StyleSmuggler's disclosure.","Continuous vulnerability scanning and a defined remediation SLA for critical flaws would have ensured rapid compensating controls were applied the moment CVE-2026-75650 was disclosed, shrinking the exploitation window.","This control mandates timely identification of technical vulnerabilities and the taking of appropriate countermeasures, including virtual patching and compensating controls when vendor patches are unavailable for zero-days."]