News Date: 2026-09-05
Operators of Magento online stores are facing an active zero-day campaign with no official vendor patch available at the time of publication. The vulnerability, named StyleSmuggler by security company Sansec, reportedly allows attackers to execute code without authenticating and install a persistent Linux backdoor.
Sansec said attacks began on September 4 and that it reproduced the unauthenticated chain against clean installations of Magento Open Source 2.4.7, 2.4.8 and 2.4.9. One confirmed victim was reportedly running the newest available security updates for its release branch, demonstrating that normal patch compliance alone could not stop this campaign.
A Two-Stage Route to Server Access
The reported attack chain first places malicious PHP content in a file written by Magento, such as a log or failure-report file. The attacker then causes the application to process that file while rendering a standard payment failure reminder. No employee or customer needs to open the resulting message, and exploitation may succeed even when email delivery fails.
Investigators found an implant installed outside the normal web root and disguised with a name resembling a Linux kernel worker. A cron entry restarted the process every five minutes, complicating manual removal. On at least one affected server, the malware also opened numerous connections to the store's Redis service, where Magento sessions were stored.
This creates risks beyond website defacement. An attacker controlling an e-commerce application may gain access to customer sessions, administrator credentials, payment integrations, API keys and commercially sensitive order information. Persistent access could also be used later to introduce a payment skimmer or manipulate the software supply chain.
Immediate Defensive Priorities
- Temporarily disable GraphQL where business and storefront architecture permit it.
- Inspect both Magento report and system log directories for unexpected PHP content.
- Search for suspicious non-root processes using kernel-like names and consuming real memory.
- Review user cron files, including entries that repeatedly restart hidden binaries.
- Preserve volatile evidence before rebooting, reinstalling packages or killing processes.
- Invalidate sessions and rotate Magento keys, administrator passwords and integration credentials after suspected compromise.
I believe merchants should treat this as a potential breach rather than a routine patching ticket. Temporary filtering rules may block the requests currently being observed, but they are not equivalent to a complete fix. Until Adobe delivers validated remediation, defenders need layered controls, expanded file monitoring and active threat hunting across the operating system as well as the Magento application directories.