How to Rotate Every Secret After a Server Compromise

When an attacker runs code on your application server, the immediate breach is only half the damage. The other half is everything that code could read on its way out: the encryptionEncryption🛡️The process of converting data into a coded format that can only be read with the correct decryption key. key, the database password, the payment gateway credentials, the API tokens your integrations use. Patching the hole that let them in does nothing about the secrets they already copied. This is why Adobe, when it shipped the emergency hotfixHotfix🛡️An out-of-cycle software update that addresses a specific urgent defect, usually a security flaw, on an existing release line without waiting for the next scheduled version. Hotfixes are typically numbered and cumulative on that line, but each covers only the issues named in its notes, so a later one may be required. for the StyleSmuggler flaw in Adobe Commerce and Magento in September 2026, did not stop at "apply the patchPatch🛡️A software update that fixes security vulnerabilities, bugs, or adds improvements to an existing program.." It told merchants to rotate the encryption key and every credential that key protected. This guide turns that instruction into an ordered runbook you can run after any application server compromise.

Why Rotation Is Not Optional

A remote code execution flaw gives the attacker the privileges of the application process. That process, by design, can decrypt its own secrets, because it needs them to work. On a Magento host the application encryption key decrypts integration tokens, payment gateway credentials and system-privileged automation tokens; on a Django or Rails host the secret key signs sessions and the environment holds database and third-party credentials. Whatever the stack, assume that anything the application could read, the attacker read.

That assumption is the whole point. You almost never have proof of what was exfiltrated, because a competent intruder does not leave a manifest, and StyleSmuggler's implant actively hid, disguising itself as a kernel threadThread🏠A low-power mesh networking protocol designed for IoT devices, used alongside Matter. and beaconing over traffic shaped to look like NTP. In the absence of proof, rotation is the only move that restores a known-good state. A patched server with stolen-but-unrotated credentials is still owned; the attacker just comes back through the front door with valid keys.

Order Matters: Stop, Rotate, Verify

Rotate in a sequence that does not lock you out or leave a window where old and new secrets both work against you.

**Freeze the environment first.** Enable maintenance mode and disable cron before you touch anything. On the Magento hosts hit by StyleSmuggler, cron was part of the attack path, because the malicious payload executed while the store rendered a scheduled failed-payment email. You do not want automated jobs firing mid-rotation, and you do not want the attacker's own cron persistence running while you work. Adobe's post-patch sequence begins exactly here.

**Rotate the root secret next.** The application encryption or secret key sits at the top because everything else is derived from or protected by it. Regenerate it, and understand that doing so invalidates data encrypted under the old key, which is the intended effect.

**Then rotate everything the root secret protected**, working outward:

• Admin and user passwords, and force re-authentication.
• API tokens: REST, SOAP, GraphQL, and any personal access tokens.
• OAuthOAuth🛡️An open standard authorization protocol that allows applications to access user resources without exposing passwords, using tokens instead of credentials. client secrets for every integration.
• Payment gateway credentials, rotated at the provider, not just in your config.
• Database credentials.
• SSH keys and deployment keys.
• Third-party and webhook API keys.

**Flush caches, re-enable cron, exit maintenance mode, and verify** each integration reconnects cleanly with its new credential. A rotation you cannot confirm took effect is not a rotation.

Before You Rotate, Confirm the Scope

Rotation closes the credential exposure, but you still need to know whether the box is clean and whether the attacker left a way back. Run the compromise assessment alongside the rotation, not after it.

Look for the persistence first. StyleSmuggler's operators dropped a Rust implant that masqueraded as processes named for kernel workers, font caching and time sync, and installed cron entries firing every few minutes. Sansec's own detection commands search for poisoned failure reports, stray PHP files under the media path, and those disguised processes. Adapt the same three checks to your stack: hunt for unexpected scheduled tasks, for writable web-facing directories containing executable code, and for processes whose names look legitimate but whose parents or network behaviour do not.

Watch egress. The StyleSmuggler implant beaconed over UDP 123 to typosquatted time-service domains, emitting server-mode packets a real client would never send. Egress filteringEgress Filtering🌐Restricting the outbound connections a system may make to an explicit list of required destinations, enforced at the network layer or through an egress proxy. It breaks payload downloads, mining-pool connections and callback channels, and turns an attacker's success signal into a detection event. and a baseline of who your servers legitimately talk to turns that kind of covert channel into an obvious anomaly. The concept explainer on how server-side template injection becomes remote code execution covers how the attacker got their foothold in the first place, which tells you which subsystems to inspect hardest.

Build the Runbook Before You Need It

The reason rotation goes badly under pressure is that nobody has the inventory. You cannot rotate credentials you have not enumerated, and the middle of an incident is the worst time to discover an undocumented integration still authenticating with a key from three years ago.

Maintain a living secret inventory: every key, where it lives, what it protects, how it is rotated, and who owns the integration on the other end. Store secrets in a manager that supports versioned rotation so you can cut over without downtime. Rehearse the sequence above on a staging environment so the on-call engineer has run it before the night it counts.

StyleSmuggler is a useful forcing function precisely because Adobe was blunt about the aftermath. A pre-authentication code execution flaw on a fully patched, widely deployed platform is not a rare event any more; the strategic piece on why self-hosted e-commerce platforms are a standing target explains why these systems keep drawing that attention. Assume you will run this runbook eventually, and write it while nothing is on fire.