StyleSmuggler: Zero-Day Magento Under Attack Since Sept. 4, No…

The StyleSmuggler vulnerability hits Magento Open Source and Adobe Commerce with unauthenticated RCE. Adobe has issued no advisory or patch, leaving merchants to fend for themselves.

A zero-day vulnerability dubbed StyleSmuggler has been hitting Magento Open Source and Adobe Commerce since September 4, 2026, at 22:40 UTC. Security firm Sansec, which discovered and documented the threat, has confirmed reproduction of the exploit chain on clean installations of versions 2.4.7, 2.4.8, and 2.4.9. As of September 6, 2026, Adobe has published no advisory, CVE identifier, patch, or workaround, leaving e-commerce merchants to manage a risk of full server compromise with unofficial tools.

Key Takeaways

The StyleSmuggler vulnerability enables unauthenticated remote code execution on Magento Open Source 2.4.7, 2.4.8, and 2.4.9, with installation of a persistent backdoor.
Attacks began on September 4, 2026, at 22:40 UTC; the first victim was running Magento 2.4.6-p15 with the July and August 2026 security patches already applied.
The backdoor is a stripped, statically linked Rust binary of approximately 1.9 MB, compiled for x86-64 and arm64 architectures, which masquerades as a kernel thread and persists via a cron job every 5 minutes.
As of September 6, 2026, Adobe has released no official mitigation; the next security release is scheduled for September 8, with no confirmation it will address this vulnerability.

How the Attack Chain Works

The StyleSmuggler mechanism operates in two stages. The first is a PHP code injection into a file that Magento itself writes during normal operations. The second is the forced execution of that code via the rendering of the standard email template named 'Payment Transaction Failed Reminder.' The critical condition is that execution occurs regardless of whether the email is actually delivered: the mere process of rendering the template is sufficient to trigger the payload.

Sansec has documented that the manipulation occurs through styles properties in the templating system, and that the chain is reproducible without any form of authentication. This means a remote attacker can achieve arbitrary code execution on the server without valid credentials, bypassing every authentication-based access control.

The Rust Implant and Silent Persistence

Once execution is gained, the payload installs a backdoor designed for persistence and camouflage. The binary is a stripped, statically linked Rust program, approximately 1.9 MB in size, compiled for both x86-64 and arm64 architectures. The background process presents with the name [kworker/u:8:0], a disguise that mimics legitimate Linux kernel worker threads and can deceive superficial system process inspections.

The file is placed at ~/.local/share/.gvfsd/gvfsd-user, and persistence is ensured by a cron job that restarts it every 5 minutes. The Disrex Group, which independently handled two compromised stores and one attacked but not breached, reported a case with 1,728 duplicate cron lines present on the system. The implant also maintained 28 simultaneous connections to the Redis session storage on port 6379, allowing data exfiltration without establishing detectable external C2 connections across the network perimeter.

Sansec stated it has "no indication that the backdoor was actually used" on observed systems, leaving the ultimate purpose of the operation open: payment data theft, persistent access for future attacks, or both.

Forced Disclosure and Adobe's Vacuum

Sansec's decision to publish before official patches were available is driven by the observation that "stores are being compromised right now," per the direct quote from the advisory. The documented timeline shows a tight sequence: first confirmed exploitation at 22:40 UTC on September 4, first eComscan flags on unrelated stores at 23:10 UTC, and the start of attack blocking by Sansec Shield at 07:15 UTC on September 5.

As of September 6, 2026, Adobe has published no advisory, CVE, patch, or workaround. The next security release is scheduled for September 8, 2026, but neither Sansec nor The Hacker News have confirmed it will include the fix for StyleSmuggler. The first known victim was running Magento 2.4.6-p15 with the July and August 2026 patches applied and a reported patch status of "clean," indicating that recent security countermeasures are insufficient to block the threat.

"Sansec is publishing early because stores are being compromised right now" — Sansec, StyleSmuggler advisory

Immediate Actions

Sansec has indicated a specific temporary mitigation: disabling GraphQL pending the release of the Adobe patch. This action impacts frontend and API functionality that depends on GraphQL, but it cuts off the verified attack surface. The Disrex Group has published nginx and Apache mitigation rules based on captured traffic, collected in two packet captures of over 200 MB each, and has made an incident-response repository with indicators and checks available.

Merchants should also verify for the presence of the [kworker/u:8:0] process running as a non-root user, the file ~/.local/share/.gvfsd/gvfsd-user, and cron jobs with a 5-minute interval pointing to suspicious paths in the user's home directory. Sansec has released SHA-256 hashes of the binary to facilitate system scans. eComscan version 1.9.7 kills the process for Shield customers, but Disrex documented at least one case of missed detection despite the massive presence of suspicious cron lines.

The Risk of Emergency Mitigations

The Disrex repository contains an explicit disclaimer in the README: "This repository was written with AI assistance, during a live incident, in a few hours." This note reveals the time pressure under which security operators had to build defense tools in the absence of vendor coordination. The situation highlights a structural fragility in the coordinated disclosure model: when a vendor leaves its customers exposed for days without even a preliminary advisory, the burden of protection shifts to independent researchers and hosting providers, with the risk of incomplete or untested production mitigations.

No infrastructure overlap emerges between the C2 indicators published by Sansec and other known groups at this time, nor is it possible to confirm the completeness of the exploit chain reconstructed by Disrex compared to the original. Sansec has not reproduced the vulnerability on Adobe Commerce on Cloud, leaving the exact scope on the managed cloud platform an open question.

Why the Situation Is Critical

Thousands of e-commerce stores operate on Magento with a threat model that requires neither authentication nor user interaction. The combination of unauthenticated RCE, a persistent backdoor with kernel-level camouflage, and direct access to Redis session storage configures a total server compromise scenario. The fact that the first victim had recent security patches suggests the vulnerability resides in a component not covered by regular patch cycles, or in a template system logic underestimated by the standard hardening process.

The coming week will be decisive: if the Adobe release on September 8 does not include the fix, merchants will have to manage a weekend of prolonged exposure with third-party tools, at best, or with the functional disabling of critical storefront components.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter