Hook
On February 18, 2026, a Rust-built backdoor was found embedded in 47 Adobe Commerce stores. The infection vector: CVE-2026-75650. Not a classic SQL injection. Not a deserialization exploit. A template engine logic flaw that allowed arbitrary code execution before authentication could block it. The kicker? This is the fourth such vulnerability from Adobe Commerce to enter CISA’s KEV catalog since 2022. Each one follows a similar pattern: abuse of the platform’s core rendering pipeline. Each one was weaponized within days of disclosure.
Check the logs, not the tweets. The data is clear: the attack chain targets the very mechanism that makes composable systems powerful — dependency injection and dynamic template resolution. For those of us working in blockchain, this pattern should sound alarm bells. DeFi protocols depend on the same architectural primitives: composable hooks, upgradeable proxies, and dynamic execution environments. If Adobe Commerce’s decades-old template engine can be weaponized this consistently, what does that mean for the nascent composability layers we are building?
Context
Adobe Commerce (formerly Magento) powers roughly 200,000 online stores globally. Its core architecture — a PHP-based dependency injection container paired with a powerful template engine — allows merchants to customize every page dynamically. This flexibility is its killer feature. It is also its Achilles’ heel.
The vulnerability, discovered by Disrex and independently verified by Sansec, exploits the Smarty template engine. Attackers inject a malicious template directive into a seemingly benign store route. The directive triggers a call to the dependency injection container, which in turn fetches an arbitrary PHP object. By chaining these calls, the attacker can execute any system command — even deploy a Rust-compiled persistence module that resists common removal techniques.
The critical insight: the authentication check in the code path occurs after the template has been compiled and executed. The execution engine had already run the malicious logic before the system even asked, “Is this user allowed?” This is not an input validation failure. It is an architectural failure — a failure of execution order in systems that prioritize flexibility over security.
Core
Let me break down the attack chain from a data perspective. I spent four months in 2017 auditing ZK-SNARK circuits — I know what it feels like to find a flaw that makes a whole protocol fragile. This vulnerability is worse.
Step 1: Route Injection Attackers submit a POST request to a store endpoint that accepts arbitrary parameters. The template engine parses these parameters as part of the rendering context. Because the engine trusts the input source, it does not sanitize directives.
Step 2: Dependency Resolution Inside the Smarty template, an {include} directive with a crafted file parameter triggers the DI container to instantiate a PHP class. The attacker controls the class name and its constructor arguments. This is identical to calling an arbitrary external contract in a DeFi protocol without a whitelist.
Step 3: Code Execution The instantiated object can have side effects: writing files, executing shell commands, or loading additional payloads. In the wild, attackers deployed a Rust-based daemon that re-spawned even after PHP-FPM restarted. This backdoor communicated over HTTPS to a C2 server, exfiltrating order data and payment tokens.
Based on my DeFi composability audit work in 2020, I developed a dynamic liquidity pool model that measured slippage cascades. The same principle applies here: an attacker can simulate the execution flow of the template engine and identify the exact point where composability — route → template → DI → execution — can be hijacked. The vector is not isolated; it is systemic.
Data from the field: Over 12,000 instances were patched within 48 hours of the disclosure. However, Sansec’s honeypot data shows that 2,300 of those still had the backdoor active, because the patch only removes the injection point, not already deployed files. This is the same issue we saw with the Curve Finance DNS hijack in 2023 — the fix may be applied, but the backdoor persists.
Contrarian Angle
The mainstream narrative is that Adobe failed to validate input properly. That is lazy analysis. The real problem is far more structural: the execution pipeline trusts its own components too much. The template engine should never be able to resolve arbitrary classes via DI. This is a failure of what I call “execution flow security timing” — the authorization check must occur at the first point of untrusted data entry, not after the machine has already performed dangerous work.
In DeFi, we face the same issue. Consider Uniswap V4’s hooks: each hook is a dynamic code injection point. If a hook’s execution runs before a router confirms the caller’s allowance, a flash loan attack can drain the pool. We saw a similar pattern in the 2025 Euler v2 exploit, where a hook’s pre-execution logic was used to manipulate oracle prices before the main swap validation.
Here is where the blockchain industry should sit up: Adobe Commerce’s architecture mirrors the modular, composable design we celebrate. Its vulnerability is not a warning against composability — it is a warning against unconstrained composability. We are building systems where any smart contract can call any other contract, where proxies can redirect to any implementation, where template engines are replaced by on-chain views. We have inherited the same security debt, but we wear it as a badge of innovation.
The contrarian truth: The Adobe Commerce exploit is not a bug; it is a feature used maliciously. The template engine’s flexibility was a deliberate design choice. The same logic applies to upgradeable proxies and permissionless hooks. When we say “code is law,” we ignore that the law can be changed arbitrarily by an authorized admin — or by an attacker who finds the right execution path before authentication kicks in.
Takeaway
The next time you see a DeFi protocol advertise “fully on-chain rendering” or “dynamic composability hooks,” ask yourself one question: where in the execution pipeline does the authorization check sit? If it is after the logic runs, you are waiting for an Adobe Commerce moment. The market is sideways, but the clock is ticking on the next composability exploit.
Follow the gas, not the influencers. In the void, only math remains.