Adobe Commerce Magento zero-day supply chain security e-commerce

StyleSmuggler: Rust-Powered Backdoor Hits Adobe Commerce Stores via Unpatched Zero-Day

8 September 2026

A zero-day vulnerability dubbed **StyleSmuggler** is being actively exploited in Adobe Commerce and Magento e-commerce platforms, allowing attackers to inject PHP code into Magento's template system and achieve remote code execution. The two-stage attack triggers a failed payment report to inject the code, then executes it via a payment failure email — requiring no user interaction. Successful attacks deploy a Rust-written backdoor that disguises itself as a legitimate system process and communicates with a command-and-control server, with exploitation observed since September 4; Adobe patches were expected on September 8, though it was unclear whether StyleSmuggler would be addressed.

A zero-day vulnerability in Adobe Commerce and Magento is being actively exploited to plant backdoors on e-commerce stores, according to researchers at Sansec. The flaw, which they've named StyleSmuggler, allows attackers to inject PHP code into Magento's template system by hiding it inside 'styles' properties, neatly sidestepping most detection.

The attack runs in two stages. First, the attacker injects malicious PHP by triggering a failure report. Then Magento helpfully executes that code when it sends out a failed payment email. No user interaction needed. The platform does the work for you.

Affected versions include Magento 2.4.7, 2.4.8 and 2.4.9, and the exploits have been observed against stores running July and August 2026 patches. So yes, fully patched installs are getting hit.

The payload itself is a backdoor written in Rust, which is a slightly unusual choice and suggests someone put genuine engineering effort into this. Once deployed, it connects to a command-and-control server and sits waiting for instructions. It disguises its C2 traffic as NTP server replies, which is a decent evasion trick given how little scrutiny NTP traffic typically gets.

Sansec spotted the campaign on September 4th at 22:40 UTC and managed to reproduce the full attack chain on clean installations within hours. The initial backdoor masqueraded as '[kworker/u:8:0]', a process name designed to blend into Linux system noise. A second variant appeared just two days later, this time posing as 'fc-cache'.

The malware phones home with a fairly comprehensive package: agent ID, hostname, username, memory and disk stats, OS version, uptime, root access status, implant version, and the store's public IP address. Whoever is running this operation wants a thorough picture of what they've landed on.

One detection signal worth watching: StyleSmuggler deliberately triggers Magento's standard 'Payment Transaction Failed Reminder' emails as part of its execution chain. An unusual spike in those messages is worth investigating, though Sansec rightly notes that legitimate declined payments produce the same notification, so it's not a slam-dunk indicator.

Adobe was expected to push scheduled patches on September 8 as part of its regular monthly cycle, but whether StyleSmuggler is actually addressed in that release remains unclear at time of writing. We've seen this pattern before: active exploitation, a patch window that doesn't quite line up, and store owners stuck in the gap.

If you're running Adobe Commerce or Magento, now would be a good time to review your logs.

READ NEXT

Chinese Hackers Weaponised a Flaw in Tencent's Sogou to Drop a Backdoor on Hundreds of Millions of Potential Targets SonicWall Zero-Days Sat Unpatched for Weeks While Hackers Quietly Planted Custom Malware JetBrains Left a Critical Flaw Unpatched. Attackers Walked Off With AWS Keys.