489/69 Monday, September 7, 2026
Sansec has disclosed active exploitation of an unpatched vulnerability in Magento Open Source and Adobe Commerce, named StyleSmuggler. Attacks have been observed since September 4, 2026. The vulnerability could allow unauthenticated attackers to execute code on online store servers and install a backdoor to maintain system access. Sansec stated that it was able to reproduce the attack on Magento Open Source versions 2.4.7, 2.4.8, and 2.4.9, while Adobe has not yet officially published a CVE identifier, CVSS score, patch, or confirmed scope of affected versions.
The attack works in two stages. First, attackers inject PHP code into data that Magento uses to generate files, such as error reports. They then trigger the system to process that data during the generation of payment failure notification emails, causing the code to execute without requiring anyone to open the email. Once the attack succeeds, attackers may install a backdoor as a background process using names designed to resemble legitimate system services, such as [kworker/u:8:0]
or fc-cache
, and create a cron job to make it run again. Sansec stated that there is currently no indication that the backdoor has been used for further attacks after installation.
While no official patch is available, administrators should inspect processes and suspicious files based on Sansec’s indicators of compromise (IoCs), including [kworker/u:8:0]
, fc-cache
, ~/.local/share/.gvfsd/gvfsd-user
, ~/.cache/fontconfig/fc-cache
, unknown cron jobs, data in var/report/
, and abnormal increases in payment failure notification emails. If GraphQL is not in use, administrators should consider temporarily disabling it until Adobe releases a patch. If signs of compromise are found, organizations should preserve evidence, assess the scope of impact, remove the backdoor, revoke sessions, and rotate related credentials.
Source: https://thehackernews.com/2026/09/unpatched-magento-and-adobe-commerce.html