A Failed-Payment Email as an Attack Vector
E-commerce security firm Sansec has identified active exploitation of a previously unknown remote code execution flaw in Adobe Commerce and Magento, dubbed StyleSmuggler. The zero-day abuses Magento's template system to plant a stealthy Rust-based backdoor on live online stores — and the trigger is something almost every store sends automatically: a payment failure notification.
No CVE identifier has been assigned yet.
How the Attack Works
StyleSmuggler is a two-stage exploit:
1. Attacker injects malicious PHP code into Magento's template
system via a crafted failure report, abusing the template's
'styles' properties to slip past detection
2. Attacker deliberately triggers a payment failure reminder email
3. When Magento generates or resends that email — including on
delivery failure — the injected template code executesBecause the trigger is a routine, automated transactional email, the attack blends into normal store operations and doesn't require an attacker to directly compromise an admin account first.
What Gets Dropped
Successful exploitation deploys a Rust-written backdoor disguised as a legitimate system process, using names like [kworker/u:8:0] or fc-cache to blend in with normal Linux process listings. The backdoor masks its command-and-control traffic as NTP requests and gathers system reconnaissance data once installed.
Affected Versions
| Product | Affected Versions | Fix Status |
|---|---|---|
| Adobe Commerce / Magento | 2.4.7, 2.4.8, 2.4.9 | Fix expected Sep 8, 2026 (Patch Tuesday) |
Sansec confirmed successful exploitation even against stores running July and August 2026 patches, indicating this is a genuine zero-day rather than a known, unpatched issue.
Timeline
| Date | Event |
|---|---|
| September 4, 2026 | Sansec identifies active exploitation campaign |
| September 4, 2026 | Sansec reproduces the exploit chain on a clean installation within hours |
| September 8, 2026 | Adobe's scheduled monthly Patch Tuesday — fix timeline for StyleSmuggler specifically remains unconfirmed |
Detection and Mitigation
Since a vendor patch isn't confirmed as of publication, store operators should focus on detection and hardening:
- Monitor for bursts of payment failure reminder emails that don't correlate with real checkout activity — a strong indicator of trigger attempts.
- Audit template configurations for unexpected 'styles' property content.
- Watch for suspicious processes named
kworkerorfc-cachethat don't match expected kernel worker or font-cache behavior, especially those making outbound traffic disguised as NTP. - Review outbound NTP-like traffic on servers that have no legitimate reason to be making frequent time-sync requests to unusual hosts.
- Apply Adobe's September 8 update as soon as it's available, and confirm explicitly whether it addresses StyleSmuggler.
- Restrict admin and template-editing access and rotate credentials if any of the above indicators are found.