Magento zero-day exploited despite full patching

A critical security vulnerability in Magento and Adobe Commerce is under active exploitation, allowing unauthenticated remote code execution (RCE) even on fully patched systems. The flaw, dubbed StyleSmuggler by Dutch security firm Sansec, was first observed in attacks on 4 September 2026. Adobe has acknowledged the issue but has not yet released a patch, CVE identifier, or public advisory as of 7 September 2026. The discovery underscores risks for hosting providers, as the exploit persists outside the web root and evades conventional detection methods.

How the exploit works

StyleSmuggler leverages an injection flaw in Magento’s template system, specifically targeting the "styles" properties to bypass existing safeguards. The attack unfolds in two stages: first, the attacker injects malicious PHP code, often by triggering a failure report. Magento then executes this code while rendering a failed payment email, regardless of whether the email is delivered or opened. Sansec confirmed the exploit works across all current Magento versions, including 2.4.7, 2.4.8, and 2.4.9, and does not require user interaction or session storage modifications.

The backdoor implant, written in Rust, disguises itself as legitimate system processes such as [kworker/u:8:0], fc-cache, or chronyd. It installs outside the web root—typically in the site user’s home directory or /tmp—and communicates via UDP packets masquerading as NTP traffic. Persistence mechanisms vary, including cron entries written directly to spool files to avoid detection in system logs. Sansec warns that an empty crontab does not guarantee a clean system, as some implants restore themselves within seconds of removal.

Impact on hosting providers

The first two confirmed victims were Magento Open Source stores hosted by Disrex, a provider running its own infrastructure under the RexHosting brand. One store, running Magento 2.4.8 with Sansec’s blocking product enabled, was compromised at 23:10 UTC on 4 September—hours before Sansec released its first blocking rules for the flaw. The second store, on Magento 2.4.7-p2, was breached at 00:55 UTC the following day. Both incidents occurred before mitigation measures were available, highlighting the exploit’s speed and stealth.

Sansec’s advisory notes that session hardening—such as moving sessions to Redis or databases—does not prevent the attack. Additionally, a separate threat actor has been observed dropping web shells into Magento’s product image cache (pub/media), complicating cleanup efforts. The implant’s ability to evade detection by mimicking kernel threads or time-sync processes further complicates incident response for providers managing shared or dedicated environments.

What to watch

Adobe’s next scheduled security release is 8 September 2026, but it remains unclear whether it will include a fix for StyleSmuggler. Until then, hosting providers and merchants must rely on third-party tools or temporary GraphQL disablement. Sansec continues to update its advisory as the investigation progresses, with new indicators and behaviors emerging daily. Providers should monitor for updates and prepare for potential widespread exploitation, given the flaw’s low barrier to entry and high impact.