Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

A Failed-Payment Email as an Attack Vector

E-commerce security firm Sansec has identified active exploitation of a previously unknown remote code execution flaw in Adobe Commerce and Magento, dubbed StyleSmuggler. The zero-day abuses Magento's template system to plant a stealthy Rust-based backdoor on live online stores — and the trigger is something almost every store sends automatically: a payment failure notification.

No CVE identifier has been assigned yet.

How the Attack Works

StyleSmuggler is a two-stage exploit:

1. Attacker injects malicious PHP code into Magento's template
   system via a crafted failure report, abusing the template's
   'styles' properties to slip past detection
2. Attacker deliberately triggers a payment failure reminder email
3. When Magento generates or resends that email — including on
   delivery failure — the injected template code executes

Because the trigger is a routine, automated transactional email, the attack blends into normal store operations and doesn't require an attacker to directly compromise an admin account first.

What Gets Dropped

Successful exploitation deploys a Rust-written backdoor disguised as a legitimate system process, using names like [kworker/u:8:0] or fc-cache to blend in with normal Linux process listings. The backdoor masks its command-and-control traffic as NTP requests and gathers system reconnaissance data once installed.

Affected Versions

Sansec confirmed successful exploitation even against stores running July and August 2026 patches, indicating this is a genuine zero-day rather than a known, unpatched issue.

Timeline

Detection and Mitigation

Since a vendor patch isn't confirmed as of publication, store operators should focus on detection and hardening:

1. Monitor for bursts of payment failure reminder emails that don't correlate with real checkout activity — a strong indicator of trigger attempts.
2. Audit template configurations for unexpected 'styles' property content.
3. Watch for suspicious processes named kworker or fc-cache that don't match expected kernel worker or font-cache behavior, especially those making outbound traffic disguised as NTP.
4. Review outbound NTP-like traffic on servers that have no legitimate reason to be making frequent time-sync requests to unusual hosts.
5. Apply Adobe's September 8 update as soon as it's available, and confirm explicitly whether it addresses StyleSmuggler.
6. Restrict admin and template-editing access and rotate credentials if any of the above indicators are found.

References

• SecurityWeek — Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Related Reading

• Telerik UI Padding-Oracle Bug Chained to Unauthenticated RCE
• Critical RCE in WPvivid Backup Plugin Threatens 900,000+