Magento and Adobe Commerce StyleSmuggler 0-Day RCE Actively Exploited in Attacks

Security researchers have discovered an actively exploited, unauthenticated remote code execution vulnerability affecting installations of Magento Open Source and Adobe Commerce.

This vulnerability, known as StyleSmuggler, allows attackers to inject PHP payloads into Magento’s template system and execute them via standard application workflows.

Sansec’s Forensics Team reported that attacks began on September 4, targeting internet-facing e-commerce stores. The team successfully replicated the entire attack chain on clean versions of Magento Open Source, specifically 2.4.7, 2.4.8, and 2.4.9.

Notably, one compromised victim was using Magento 2.4.6-p15, which had security patches from July and August 2026 installed and a clean patch-status report, suggesting that the currently available patches do not address this vulnerability.

How StyleSmuggler Works

StyleSmuggler exploits style properties to circumvent existing safeguards in Magento’s template-handling functionality. The attack follows a two-stage process:

1. The attacker injects, or “poisons,” PHP code into content generated by Magento, potentially via a mechanism for generating failure reports.
2. Later, Magento renders the poisoned content and executes the injected code when a failed payment notification email is processed.

The malicious PHP code executes during email rendering, so administrators do not need to open the resulting “Payment Transaction Failed Reminder” message for the compromise to occur.

The attack can still succeed even if email delivery fails, so the absence of suspicious emails should not be taken as evidence that a store is unaffected.

Researchers observed that attackers deployed a compact Rust-based background implant after gaining code execution. Earlier samples disguised themselves as the Linux process [kworker/u:8:0], while newer versions, released on September 6, use `fc-cache` to blend in with legitimate system activity.

The `fc-cache` variant copies itself to `~/.cache/fontconfig/fc-cache` and establishes persistence via cron jobs, restarting twice an hour. It writes its process ID to a temporary lock file named `/tmp/.fc_<8hex>.lock`.

The implant disguises command-and-control (C2) traffic to appear as Network Time Protocol (NTP) activity. Every 60 seconds, it resolves the domain `ntp.timesync.to` and sends 48-byte UDP packets over port 123.

Although these packets mimic NTP server replies, most of their contents are chunked MessagePack data that includes the system’s hostname, username, operating system version, memory and disk usage, uptime, root status, implant version, and public IP address.

Before initiating communication with its C2 server, the malware queries public IP discovery services such as `api4.ipify.org`, `ipv4.icanhazip.com`, `ipv4.ident.me`, and `ipinfo.io`.

It uses a truncated User-Agent string that does not match a legitimate browser’s. Additionally, the malware checks the `TracerPid` value in `/proc/self/status`; if debugging is detected, it installs itself but does not communicate with its operators.

Merchants should immediately restrict access to Magento GraphQL if they are not using a dedicated mitigation product. Sansec recommends deploying its Shield protection, scanning hosts with eComscan, and rotating Magento credentials if any suspicious persistence or processes are identified.

Administrators should investigate any unexpected surges in failed payment reminder emails, suspicious cron entries, template-report artifacts containing `x_trace_`, and processes named `[kworker/u:8:0]` or `fc-cache`.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.