A newly disclosed actively exploited zero-day vulnerability in Magento and Adobe Commerce allows unauthenticated attackers to execute code remotely on affected e-commerce stores.
The flaw, named StyleSmuggler, was discovered by Sansec’s Forensics Team, which warned that exploitation began on September 4. The issue is currently unpatched and impacts all supported Magento and Adobe Commerce versions, including Magento Open Source 2.4.9.
Sansec reproduced the complete unauthenticated attack chain on clean Magento Open Source installations of 2.4.7, 2.4.8, and 2.4.9.
Hackers Exploit StyleSmuggler Magento and Adobe Commerce Zero-Day
Sansec also identified a victim running Magento 2.4.6-p15 with July and August 2026 security patches installed, despite the system reporting a clean security:patch-status result.
StyleSmuggler abuses Magento’s template system and uses styles properties to evade existing safeguards. The exploit operates in two stages.
Attackers first inject, or poison, PHP code into Magento-generated content, potentially by triggering a failure report. They then cause Magento to render that poisoned content through a failed payment email workflow.
The injected code executes while Magento renders the standard “Payment Transaction Failed Reminder” email. A recipient does not need to open the email for exploitation to occur, because execution happens server-side during template rendering.
The attack may also succeed if the email cannot be delivered, meaning the absence of a failed-payment notification does not establish that a store is safe.
Unexpected spikes in failed-payment reminder messages should prompt an immediate investigation. However, merchants should account for the possibility that legitimate declined transactions can generate the same alerts.
Following successful exploitation, attackers deploy a compact Rust-based backdoor as a background process. Early versions of the implant disguise themselves as [kworker/u:8:0], mimicking a Linux kernel worker process.
Newer samples observed on September 6 use the name fc-cache, impersonating a font-cache utility.
The fc-cache variant copies itself to ~/.cache/fontconfig/fc-cache and establishes persistence through a cron job scheduled to restart the implant twice every hour. It stores a PID lock file in /tmp/.fc_<8hex>.lock, using the first half of its agent identifier in the filename.
Sansec found that the malware communicates with the command-and-control infrastructure via traffic that resembles Network Time Protocol activity. Every 60 seconds, it resolves ntp.timesync.to and sends 48-byte UDP packets to port 123.
The malware can use ntp.synctime.to and ntp.syncstime.to as fallback domains. Although the packets resemble NTP replies, only their first four bytes conform to the protocol.
The remaining bytes contain chunked MessagePack data that can disclose the infected host’s agent ID, hostname, username, operating-system details, uptime, memory and disk usage, root status, and implant version.
Administrators should inspect their infrastructure for kworker or fc-cache processes, suspicious cron entries, hidden files in /tmp, and template artifacts containing x_trace_ within Magento’s var/report/ directory.
Sansec has released detection and remediation support through its Shield and eComscan products.
Merchants finding suspicious processes should isolate affected servers, investigate for secondary backdoors, remove persistence mechanisms, and rotate Magento credentials.
Give your security team the visibility and context to investigate suspicious activity faster and contain threats before business impact grows. Strengthen Your Investigations with ANY.RUN
