← News
/DISPATCH · 2026-09-07

Magento Zero-Day StyleSmuggler Exploited In the Wild: Unauthenticated RCE Drops Rust Backdoor

Sansec disclosed StyleSmuggler, an unauthenticated RCE chain against Magento and Adobe Commerce. Exploited in the wild since September 4 with a persistent Rust backdoor. Adobe has not issued a patch or CVE.

Incident Overview

Dutch e-commerce security firm Sansec issued an emergency advisory on September 5 disclosing an unauthenticated remote code execution (RCE) chain, codenamed StyleSmuggler, affecting Magento Open Source and Adobe Commerce. Attackers have been exploiting the vulnerability since September 4 to compromise live stores and install a persistent backdoor. As of September 6, Adobe has not released a patch, CVE, official advisory, or workaround. Its Commerce security bulletin index still stops at the August 11 update. Sansec said it disclosed early because stores were being compromised in real time while the advisory was being written.

Sansec fully reproduced the chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 installs, confirming all current versions including the latest 2.4.9 are affected. The first confirmed victim ran 2.4.6-p15 and had applied Adobe's July and August 2026 security updates. Patch-status checks were fully green—fully patched stores are still broken. Magento hosting and development firm Disrex Group independently confirmed the attacks the same day: two compromised stores it handled ran 2.4.8 (with Sansec Shield WAF deployed and enabled) and 2.4.7-p2 (eight patch levels behind). Both attacks fell in the roughly 8-hour window between first observed exploitation and first defensive rules going live.

Technical Details

The chain has two stages. Core is Magento's template processing system. The attacker first manipulates the `styles` attribute via a GraphQL request, injecting malicious PHP into a file Magento generates at runtime (e.g. a payment-failure report). The attacker then triggers Magento to send a "Payment Transaction Failed Reminder" email, causing the tainted content to execute during server-side rendering. The recipient does not need to open or receive the mail.

After successful exploitation, the attacker deploys an ~1.9MB statically linked Rust implant (compiled for both x86-64 and arm64) under the site user's home directory at `~/.local/share/.gvfsd/`, not in a web-accessible path. The backdoor masquerades as a legitimate Linux kernel thread `[kworker/u:8:0]`, persists by writing the crontab spool file directly, restarts every five minutes, and can evade standard logging. Some variants do not establish outbound connections; they query the store's own Redis instance to steal session data and bypass network-layer monitoring.

Impact Assessment

Remediation

Until Adobe ships an official patch, Sansec's temporary mitigation is to disable GraphQL. Classic Luma and Hyvä theme frontends typically do not depend on GraphQL and can disable it outright. Headless and PWA architectures require GraphQL; those stores should deploy edge/WAF rules to rate-limit GraphQL queries and detect/block anomalous requests (Disrex has published Apache rules based on real attack traffic; validate in a test environment first).

All Magento/Adobe Commerce operators should hunt for compromise immediately. Host-side detection commands published by Sansec:

`crontab -l | grep -i gvfsd
ls -la ~/.local/share/.gvfsd/ /tmp/.kw_* /tmp/.gvfsd-* 2>/dev/null
ps -eo pid,comm,args | grep -i kworker
grep -rl 'X_TRACE_' var/report/`

Also: rotate all potentially leaked credentials; disable `proc_open` at the server layer and mount temp directories noexec to block payload execution. Community unofficial patches (Disrex, ProxiBlue, Graycore) only harden some classes and are not a complete fix. Adobe's next scheduled security release is September 8; it is unclear whether it covers this vulnerability. Operators should watch closely.

References