Magento and Adobe Commerce stores targeted by StyleSmuggler zero-day
Attackers have begun exploiting an unpatched vulnerability dubbed StyleSmuggler in Magento Open Source and Adobe Commerce to execute code on store servers without authentication and deploy persistent backdoors. Dutch e-commerce security company Sansec said exploitation began on September 4. It reproduced the unauthenticated chain on clean Magento Open Source 2.4.7, 2.4.8 and 2.4.9 installations.
As of September 6, Adobe had not issued an advisory, CVE, patch or workaround. Sansec said all current Magento versions were affected, including 2.4.9. Its first identified victim was running 2.4.6-p15 with Adobe’s July and August 2026 security updates, the latest patch level available for that release line.
Attack chain writes and executes malicious PHP
Sansec’s outline describes a two-stage attack. The first stage inserts PHP into a file Magento writes itself, such as a failure report. The attacker then triggers Magento’s standard “Payment Transaction Failed Reminder” email, causing the malicious content to run while the platform renders the message. No recipient needs to open the email, and the attack can succeed even when email delivery fails.
Disrex Group, which responded to two compromised stores, published an independent analysis but warned that its incident-response repository was assembled rapidly during a live event and had not been fully reviewed. Its interpretation is that the injected content reaches dependency-injection compiler code and ultimately includes an attacker-selected path. Sansec has not confirmed that technical reading or released the complete exploit chain.
The campaign’s timing recalls how SAP Commerce Cloud attacks after patching showed attacks against SAP Commerce Cloud shortly after a patch, while this incident presents the more difficult condition of active exploitation before a vendor fix is available.
Backdoor persistence and detection limits
Sansec identified an implant masquerading as [kworker/u:8:0], a name associated with a Linux kernel thread. It is installed under the site user’s home directory and restarted through cron every five minutes. Disrex reported that one infected system contained the cron line 1,728 times and that the running implant restored it within a second of removal.
Disrex described the malware as a stripped, statically linked Rust binary for x86-64 and arm64. On one store it maintained 28 connections to the local Redis service on port 6379, where it read Magento session storage. The investigators advised checking both the on-disk binary and the executable exposed through /proc/<pid>/exe, because one running sample differed from the file on disk.
Indicators may appear in both var/report/ and var/log/system.log. Disrex said its two cases used system.log and would not have matched Sansec’s initial report-directory check. The trigger header also changed during September 5, so searches should account for its pattern rather than rely only on one exact marker.
Mitigation before a vendor update
Sansec advised stores that do not use its Shield product to disable GraphQL until Adobe supplies a temporary fix. Disrex noted that this can disrupt headless and progressive web app storefronts, whereas many classic and Hyvä storefronts do not require GraphQL. Its web-server rules address observed query-string traffic, but the company found that equivalent parameters in POST and JSON bodies still reached PHP.
Disrex also published code guards and server hardening guidance, while stressing that unofficial mitigations are not a complete fix. It recommends disabling proc_open in PHP where operationally feasible and mounting /tmp, /var/tmp and /dev/shm with noexec to restrict execution of downloaded binaries.
For confirmed infections, businesses should preserve evidence, remove the cron persistence before killing the process, avoid rebooting, flush session storage, and rotate the Magento crypt key, administrator passwords, payment-provider keys and integration credentials. Until Adobe publishes a fix, incident response and layered containment are the practical priorities for Magento operators.