Threat actors are actively exploiting a zero-day vulnerability affecting Adobe Commerce and Magento, using the flaw to execute malicious PHP code and deploy a stealthy backdoor on compromised online stores. The vulnerability, dubbed StyleSmuggler by cybersecurity firm Sansec, affects multiple recent Magento releases and has reportedly been exploited even against systems running security patches issued in July and August 2026.
StyleSmuggler abuses Magento’s template system in an unusual way. According to Sansec, attackers can inject PHP code while concealing the malicious content insidestylesproperties, allowing the payload to evade detection and eventually execute on the server.
The exploitation process occurs in two stages. Attackers first inject the malicious PHP code by generating a failure report, then deliberately trigger Magento’s standard Payment Transaction Failed Reminder email. When Magento processes and resends the failed-payment notification, the injected code is executed without requiring interaction from an administrator or customer.
Sansec says the remote code execution vulnerability works against Magento versions 2.4.7, 2.4.8 and 2.4.9. More concerningly, exploitation has succeeded against deployments containing Adobe’s July and August 2026 security updates, indicating that fully patched stores may still be exposed to the zero-day.
The security company first detected the campaign on September 4 and was able to reproduce the exploitation chain against clean installations within hours. This suggests the attack is reliable enough to represent a significant risk for organizations operating vulnerable internet-facing Commerce or Magento infrastructure.
Successful exploitation results in the deployment of a backdoor written in Rust. Once installed, the malware connects to attacker-controlled command-and-control infrastructure and waits for instructions, effectively giving the operators persistent remote access to the compromised e-commerce server.
The attackers have also attempted to disguise the malicious process as legitimate Linux system activity. The first version observed by Sansec masqueraded as[kworker/u:8:0], a name designed to resemble a kernel worker process. On September 6, researchers identified another version using the namefc-cache, which normally belongs to a legitimate font-configuration utility.
This type of process masquerading can make initial investigation more difficult because administrators reviewing a process list may overlook names that resemble legitimate operating-system components. Security teams therefore need to examine process behavior, executable locations, network connections and parent-child relationships rather than relying solely on process names.
The backdoor also attempts to hide its command-and-control traffic by making communications appear to be responses from an NTP server. The technique allows malicious network activity to resemble ordinary time-synchronization traffic, potentially reducing the likelihood that suspicious communications will immediately attract attention.
Before communicating with its command-and-control infrastructure, the malware collects detailed information about the compromised host. The data includes an agent identifier, hostname, username, operating-system version, uptime, memory and disk usage, root-access status and the version of the implant itself. The malware also determines the store’s public IP address before establishing communication with the attackers.
For defenders, one of the most useful indicators may be unusual bursts of failed-payment emails. Because StyleSmuggler deliberately triggers Magento’s Payment Transaction Failed Reminder mechanism as part of the exploitation process, a sudden increase in these messages could indicate suspicious activity. However, legitimate declined transactions can generate the same notifications, so the emails should be treated as an investigative signal rather than definitive proof of compromise.
The vulnerability is particularly dangerous because successful exploitation does not require the victim to click a malicious link, open an attachment or interact with the attack in another way. The malicious code can execute when Magento resends the relevant email or when email delivery itself fails, making the vulnerable server responsible for triggering the attack chain.
Compromising an e-commerce server can have consequences far beyond the initial web application. Online stores process customer identities, orders, payment-related information and administrative credentials, while their servers may also contain database passwords, API keys and integrations with payment processors, logistics platforms and other business systems.
Persistent access to this infrastructure could potentially allow attackers to steal sensitive information, manipulate store content or establish additional persistence. Historically, compromised Magento stores have also been attractive targets for web-skimming operations in which malicious JavaScript is injected into checkout pages to capture payment information.
The current StyleSmuggler campaign therefore deserves attention even if the observed Rust backdoor is the attacker’s immediate payload. Once arbitrary code execution has been achieved on an internet-facing commerce platform, defenders need to consider the possibility that additional credentials or systems may have been exposed.
Organizations discovering evidence of exploitation should not assume that installing a future patch will completely resolve the incident. Patching closes the original entry point, but a previously compromised server may still contain the Rust implant or other persistence mechanisms installed after exploitation.
Incident response should consequently include investigation of suspicious processes, unexpected binaries, outbound connections, modified Magento files and unusual account activity. Credentials and secrets accessible from a confirmed compromised server may also need to be rotated depending on the extent of attacker access.
Adobe is scheduled to release its regular monthly security updates on September 8, but at the time of SecurityWeek’s report it was unclear whether those updates would include a fix for StyleSmuggler. SecurityWeek contacted Adobe for additional information, but no response had yet been included in the report.
Until a definitive fix is available, administrators running Adobe Commerce or Magento should closely monitor their environments for the indicators described by Sansec. Particular attention should be paid to unusual failed-payment notifications, suspicious processes masquerading as[kworker/u:8:0]orfc-cache, unexpected outbound communications and other signs that the application server may already have been compromised.
StyleSmuggler demonstrates why zero-day vulnerabilities in e-commerce infrastructure can become urgent security problems. These platforms are directly exposed to the internet, handle valuable business and customer information and frequently connect to numerous external services, giving attackers multiple opportunities to expand an intrusion once remote code execution is achieved.
The fact that attackers are already exploiting the vulnerability against recently patched Magento installations makes the situation especially important for defenders. Until Adobe provides a complete remediation, organizations cannot rely solely on their normal patching status and should combine updates with active monitoring and compromise assessment to determine whether attackers reached their stores before the vulnerability was closed.