Hackers Exploit Critical Magento StyleSmuggler security flaw to Deploy PSK Agent RAT and Hijack Servers

What happened

Attackers exploited the critical StyleSmuggler vulnerability in Magento and Adobe Commerce to deploy PSK Agent, a remote access trojan enabling command execution, traffic proxying, and persistent server access.

Imperva’s earlier analysis reports a CVSS score of 10.0 and exploitation preceding Adobe’s emergency hotfix.

Researchers identified five attack clusters using nearly identical PHP payloads against /paypal/transparent/response/. Four source addresses generated most observed traffic: 132[.]243[.]238[.]178, 86[.]107[.]100[.]105, 185[.]18[.]222[.]13, and 64[.]204[.]130[.]9.

The attack begins by placing PHP source in the endpoint’s query string. The campaign ran September 9–13, 2026, targeting stores across Western Europe, North America, and Asia-Pacific.

cyber security Cyber Security News Vulnerability 3 min. A recurring delivery URL, transfer[.]chinow[.]abrdns[.]com/get/psk_agent.sh, appeared 96 times across 12 payload variants, suggesting standardized exploitation rather than isolated intrusions.

Their geographic spread is consistent with rented or compromised infrastructure, not reliable evidence of the operator’s physical location or nationality on its own. Magento records the malicious request in a failure report under var/report/.