--- url: "https://www.xcademia.com/news/stylesmuggler-magento-zero-day-exploited-in-active-attacks-enabling-unauthenticated-rce" title: "StyleSmuggler Magento Zero-Day Exploited in Active Attacks, Enabling Unauthenticated RCE" description: "StyleSmuggler is a Magento zero-day under active attack, enabling unauthenticated RCE and backdoor deployment on vulnerable eCommerce stores." publishedAt: "2026-09-07T11:03:36.342+00:00" updatedAt: "2026-09-07T12:30:43.983299+00:00" type: news category: cybersecurity source_name: Sansec Forensics Team source_url: "https://sansec.io/research/stylesmuggler" tags: - "#Magento" - "#AdobeCommerce" - "#StyleSmuggler" - "#ZeroDay" - "#RemoteCodeExecution" - "#RCE" - "#eCommerceSecurity" - "#Cybersecurity" --- # StyleSmuggler Magento Zero-Day Exploited in Active Attacks, Enabling Unauthenticated RCE > A new Magento and Adobe Commerce zero-day dubbed StyleSmuggler is being actively exploited, allowing unauthenticated attackers to execute malicious PHP code and deploy persistent backdoors on vulnerable stores. Source: **Sansec Forensics Team** · 7 September 2026 **A** newly identified zero-day vulnerability affecting Magento and Adobe Commerce is being actively exploited in the wild, according to eCommerce security firm Sansec. The vulnerability, tracked by Sansec as **StyleSmuggler**, can provide unauthenticated attackers with remote code execution. Sansec says it successfully reproduced the attack chain on clean installations of Magento Open Source 2.4.7, 2.4.8 and 2.4.9. The investigation was published on September 5 and updated on September 6 as researchers observed additional attack infrastructure and persistence techniques. Sansec said it released the findings early because stores were already being compromised. ## What is StyleSmuggler? StyleSmuggler abuses Magento's template system to inject malicious code. According to Sansec, the attack involves two primary stages. First, an attacker poisons PHP code within Magento's template environment. The malicious content can be introduced through mechanisms such as generating a failure report. The second stage causes Magento to execute the poisoned code through a failed-payment email workflow. This is particularly significant because the exploitation does not require the attacker to authenticate to the affected Magento installation. ## Current Magento versions are affected Sansec says it reproduced the complete unauthenticated exploitation chain against clean Magento Open Source installations running versions **2.4.7, 2.4.8 and 2.4.9**. The first confirmed victim identified by Sansec was running Magento 2.4.6-p15 with the July and August 2026 security patches applied. Sansec said the installation reported a clean `security:patch-status`. That detail is important because it demonstrates that simply having the latest available patches installed at the time did not necessarily protect the affected installation from StyleSmuggler. ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1788778948049-info1--59-.webp) ## Why failed-payment emails matter One unusual aspect of the attack is its use of Magento's standard **Payment Transaction Failed Reminder** email mechanism. Sansec reports that attackers deliberately trigger this workflow to make Magento render the malicious content. The recipient does not need to open the resulting email for the exploit to work. The malicious code executes while Magento processes the email template. Sansec also says the attack can succeed even if email delivery itself fails. As a result, administrators should not assume that the absence of suspicious payment-failure emails means a store is unaffected. Unexpected bursts of failed-payment reminder emails can therefore serve as an investigation trigger, although legitimate payment declines can generate the same messages. ## From remote code execution to a persistent backdoor Sansec observed a secondary payload following successful exploitation. The researchers found a small **Rust-based backdoor** that establishes communication with an attacker-controlled command-and-control server. Sansec said it had not seen evidence that the backdoor had been weaponized at the time of publication. The initial observed process used the name: `[kworker/u:8:0]` Researchers later identified another variant using the process name: `fc-cache` The second variant copies itself into a location under the user's cache directory and establishes a cron job designed to restart the malware periodically. ## Attackers disguise command-and-control traffic The newer `fc-cache` variant adds another layer of stealth. Sansec says the malware communicates using UDP traffic over port 123, normally associated with the Network Time Protocol. Rather than looking like conventional command-and-control traffic, the implant sends packets that resemble NTP server responses. Sansec says only the first four bytes are actually NTP-related, while the remaining data carries a MessagePack record containing information about the infected environment. The collected information includes details such as the agent ID, hostname, username, operating system version, memory and disk usage, uptime, privilege status and implant version. This approach is notable because traffic to UDP port 123 can appear less suspicious in environments where outbound network filtering is not tightly controlled. ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1788778966142-info2--60-.webp) ## Persistence mechanisms observed by researchers Sansec identified multiple filesystem and process indicators associated with the campaign. Among the observed locations and process names are: - `~/.cache/fontconfig/fc-cache` - `/tmp/fc-cache` - `/tmp/.fc_.lock` - `~/.local/share/.gvfsd/gvfsd-user` - `process fc-cache` - `process [kworker/u:8:0]` The researchers also observed cron entries designed to restart malicious processes. These indicators can help security teams investigate potentially compromised Magento environments. ## Sansec observed active exploitation beginning September 4 Sansec's timeline places the first confirmed StyleSmuggler exploitation at **22:20 UTC on September 4, 2026**. The company said its eComscan scanner detected the implant on unrelated stores approximately 50 minutes later. On September 5, Sansec reproduced the attack chain against clean Magento 2.4.7, 2.4.8 and 2.4.9 installations and began blocking StyleSmuggler exploitation through its Shield service. On September 6, researchers reported the newer `fc-cache` persistence indicators. ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1788778989543-info3--57-.webp) ## What Magento administrators should do Sansec recommends taking immediate steps to determine whether a Magento or Adobe Commerce environment has been targeted or compromised. The company recommends: 1. **Block StyleSmuggler exploitation.** Sansec says its Shield rules were deployed to block the observed attacks. 2. **Scan the environment for compromise.** Sansec recommends using eComscan to look for implants and secondary backdoors. 3. **Review suspicious processes and filesystem locations.** Administrators should investigate indicators such as `kworker`, `fc-cache`, `.gvfsd` and the associated temporary directories. 4. **Review unexpected payment-failure activity.** Bursts of Payment Transaction Failed Reminder emails can justify further investigation, although legitimate payment failures can produce similar activity. 5. **Rotate Magento credentials if compromise is suspected.** Sansec specifically recommends credential rotation when suspicious processes associated with the campaign are found. Sansec also says that, if its Shield protection is not being used, administrators can temporarily disable GraphQL while waiting for an official Adobe fix. However, Sansec noted that Adobe's next scheduled security release was September 8 and that it was not yet known whether that release would address StyleSmuggler. ## Indicators of compromise Sansec published several indicators associated with the campaign, including malware download infrastructure, C2 endpoints, suspicious processes, filesystem paths and request patterns. Among the network indicators are: - `99.84.67.186:443` - `ntp.timesync.to:123` - `ntp.synctime.to:123` - `ntp.syncstime.to:123` - `88.216.72.181` Sansec also identified suspicious paths and request patterns involving Magento's GraphQL endpoint and payment-related functionality. Security teams investigating affected systems should use the complete IOC list in the original Sansec report rather than relying on a subset reproduced here. ## The broader security lesson The StyleSmuggler campaign highlights a recurring challenge for internet-facing eCommerce platforms: security teams can apply every currently available patch and still face exposure when a newly discovered vulnerability has not yet been fixed. The first victim identified by Sansec reportedly had recent security patches applied and a clean patch-status check. This demonstrates why patch management needs to be complemented by runtime monitoring, intrusion detection and compromise assessment. The use of legitimate Magento functionality as part of the exploitation chain is also significant. Instead of relying solely on an obviously malicious endpoint, the attack abuses application behaviour that already exists within the platform. For enterprises, this could mean that monitoring needs to focus not only on known malicious files and network destinations, but also on unusual application behaviour and unexpected combinations of otherwise legitimate workflows. The campaign also demonstrates how post-exploitation activity can be designed to blend into normal infrastructure. The observed `fc-cache` variant, for example, uses a process name associated with a legitimate Linux utility and communicates through traffic designed to resemble time synchronization. ## Adobe fix remains a key development At the time of Sansec's September 6 update, an official Adobe fix for StyleSmuggler had not yet been confirmed in the research. Sansec listed September 8 as Adobe's next scheduled security bulletin but explicitly stated that it was unknown whether that release would address the vulnerability. **Additional details were not disclosed in the announcement.** Administrators running Magento or Adobe Commerce should therefore monitor Adobe's official security advisories and Sansec's ongoing research for updated mitigation and patch information. ## Bottom line StyleSmuggler represents a serious risk for Magento and Adobe Commerce operators because the reported attack chain combines **unauthenticated remote code execution, active exploitation and post-exploitation persistence**. Sansec's investigation remains ongoing, and the company has said that additional technical details will be added as its analysis develops. For now, organizations operating affected eCommerce platforms should treat unexpected payment-failure activity, suspicious background processes, unfamiliar cron jobs and unusual outbound traffic as potential investigation signals. The priority should be to determine whether systems have been exposed, identify any signs of compromise and follow official vendor guidance as soon as a confirmed security fix becomes available. ## Original source https://sansec.io/research/stylesmuggler ## Tags `#Magento` · `#AdobeCommerce` · `#StyleSmuggler` · `#ZeroDay` · `#RemoteCodeExecution` · `#RCE` · `#eCommerceSecurity` · `#Cybersecurity` --- ## About this content This Markdown news article is the citation-grade twin of [StyleSmuggler Magento Zero-Day Exploited in Active Attacks, Enabling Unauthenticated RCE](https://www.xcademia.com/news/stylesmuggler-magento-zero-day-exploited-in-active-attacks-enabling-unauthenticated-rce). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/stylesmuggler-magento-zero-day-exploited-in-active-attacks-enabling-unauthenticated-rce - Publisher: Xcademia — https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt