1name: crowdsecurity/vpatch-CVE-2026-75650
2description:  Magento "StyleSmuggler" RCE (CVE-2026-75650)
3
4rules:
5  - or:
6    - zones:
7        - URI_FULL
8      transform:
9        - lowercase
10        - urldecode
11      match:
12        type: regex
13        value: '<\?(php|=)|\\u003c\?'
14    - zones:
15        - HEADERS
16      variables:
17        - store
18      transform:
19        - lowercase
20        - urldecode
21      match:
22        type: regex
23        value: '<\?|\\u003c\?'
24
25labels:
26  type: exploit
27  service: http
28  confidence: 3
29  spoofable: 0
30  behavior: 'http:exploit'
31  label: 'Adobe Commerce & Magento - RCE'
32  classification:
33    - cve.CVE-2026-75650
34    - attack.T1190
35    - cwe.CWE-1336
36