On September 4, 2026 attackers began exploiting a new, unpatched vulnerability in Magento Open Source and Adobe Commerce that allows unauthenticated remote code execution. The flaw, dubbed StyleSmuggler by Dutch e‑commerce security firm Sansec, lets malicious actors run arbitrary PHP code on the victim’s server and install a persistent backdoor – all without needing any credentials.
The vulnerability was first reported by CyberSecurityNews, which highlighted that the attack chain can drop a statically linked Rust binary (~1.9 MB) masquerading as a kernel worker thread.
Recorded Future’s H1 2026 malware trends report notes the rise of supply‑chain exploits and zero‑days in e‑commerce platforms, emphasizing the threat of trusted‑tool abuse.
Sansec reproduced the full attack chain on clean installations of Magento 2.4.7, 2.4.8 and 2.4.9, confirming that all current versions of Magento Open Source and Adobe Commerce are vulnerable. The first victim was running 2.4.6‑p15 with the July and August 2026 security patches applied, demonstrating that even fully patched stores were compromised.
Adobe has not yet issued a CVE identifier, advisory, or patch as of September 6, 2026, and its security bulletin still ends on the August 11 update.
Mitigation steps include: disable GraphQL temporarily for stores that do not rely on headless front‑ends; audit var/report and var/log/system.log for the marker string used by Sansec; disable proc_open, mount temporary directories with noexec, and enforce strict file permissions; monitor for suspicious cron entries writing to /var/spool/cron/crontabs and for processes named [kworker/u:8:0] running under the web‑user account; apply any unofficial patches released by the community while awaiting an official Adobe fix.
Adobe’s next scheduled security release is set for September 8, 2026, but the company has not confirmed whether it will address StyleSmuggler. Until then, store owners should harden their environments and monitor logs closely.
Top comments (0)