An Unpatched Zero-Day, Already Under Active Attack
Dutch e-commerce security firm Sansec disclosed on September 5 that attackers are actively exploiting a new, unpatched zero-day in Magento Open Source and Adobe Commerce that lets them run malicious code on a store's server without ever logging in. Sansec has named the flaw StyleSmuggler, and says it affects all current versions of the platform, including the latest release, 2.4.9.
Sansec first spotted the campaign on September 4 at 22:40 UTC and had reproduced the full attack chain against clean installations within hours. Because stores are being compromised in real time, Sansec chose to publish its findings early, as an active and developing investigation, rather than wait for a patch.
How StyleSmuggler Works
The attack is unauthenticated and runs in two stages:
- Poisoning — the attacker injects malicious PHP code into Magento's template system by abusing the platform's
stylesproperties, a path that evades Magento's existing template-injection safeguards. - Triggering — the poisoned code is executed when Magento renders a failed-payment notification email.
Critically, a store owner doesn't need to open the email for the exploit to fire — the malicious code runs the moment Magento renders the email template, and the attack succeeds even when the email fails to send. In other words, an empty inbox is not evidence that a store is safe.
Sansec reproduced the complete unauthenticated exploit chain against clean installs of Magento Open Source 2.4.7, 2.4.8, and 2.4.9.
Fully Patched Stores Were Still Compromised
The severity here isn't just the pre-auth RCE — it's that patch discipline didn't protect victims. Sansec's first confirmed victim was running Magento 2.4.6-p15, with the July and August 2026 security patches applied, and a clean result from Magento's own security:patch-status check. StyleSmuggler exploits template-rendering logic that existing patches don't touch, which means being current on Adobe's monthly security bulletins was not sufficient to prevent compromise.
The Backdoor Payload
Sansec found that attacks launched before its Sansec Shield protection went live in the early morning of September 5 may have already succeeded. On compromised stores, investigators observed a background process named [kworker/u:8:0] — disguised to look like a normal Linux kernel worker thread — running as a persistence mechanism after initial compromise.
Sansec has released eComscan 1.9.7 for Shield customers, specifically to detect and terminate this implant and hunt for any secondary backdoors dropped alongside it.
Why This Matters
StyleSmuggler is the latest in a string of severe Magento/Adobe Commerce vulnerabilities disclosed through 2026, following PolyShell (unauthenticated file-upload RCE, March 2026) and SessionReaper (session-hijacking flaw), also both surfaced by Sansec. The platform's recurring exposure to critical, pre-auth vulnerabilities — combined with the fact that this one bypasses standard patch hygiene entirely — makes it a priority incident for any organization running Magento Open Source or Adobe Commerce right now, whether patched to the latest release or not.
As of publication, no official Adobe patch is available. Store operators are dependent on compensating controls until one ships.
Recommended Actions
- Deploy Sansec Shield (or an equivalent runtime protection layer) to block StyleSmuggler exploitation attempts in real time, since no vendor patch exists yet.
- Run eComscan 1.9.7 or similar tooling to check for the
[kworker/u:8:0]implant and other secondary backdoors, even on stores that show no outward signs of compromise. - Audit failed-payment email templates and the
stylesproperties path in your Magento/Adobe Commerce installation for signs of injected code. - Do not rely on
security:patch-statusalone — a clean patch status does not mean a store is protected against this specific flaw. - Monitor for this to escalate — watch Adobe's security bulletins closely for an official fix and apply it immediately once released.