A zero-day vulnerability in Adobe Commerce and Magento e-commerce platforms is being exploited by threat actors to inject backdoors into online stores. Cybersecurity firm Sansec has identified the attack, dubbed “StyleSmuggler,” which allows attackers to inject PHP code into Magento’s template system, making it difficult for detection. The exploitation started on September 4 and has already targeted deployments running the July and August 2026 patches.
The attack works in two stages: first, the PHP code is injected by generating a failure report, and then Magento executes the code via a failed payment email. This remote code execution (RCE) flaw affects Magento versions 2.4.7, 2.4.8, and 2.4.9. Successful attacks have deployed a backdoor against Commerce and Magento stores, written in Rust, which connects to a command-and-control (C&C) server and waits for commands.
The malware disguises its communication with the C&C server as NTP server replies, making it challenging to detect. The messages carry host information, including agent ID, hostname, username, memory and disk usage, OS version, uptime, root access, and implant version. Before beaconing to the C&C server, the backdoor identifies the store’s public IP.
Sansec notes that StyleSmuggler deliberately triggers Magento’s standard “Payment Transaction Failed Reminder” email. Unexpected bursts of these messages are a reason to investigate, although legitimate declined payments can generate the same notification. The malicious code is executed when Magento resends the email, as well as when email delivery fails, and no user interaction is required for successful exploitation.
Adobe is expected to roll out scheduled fixes on September 8 as part of its monthly Patch Tuesday updates, but it’s unclear when StyleSmuggler will be addressed. Sansec discovered the campaign on September 4th, 22:40 UTC and reproduced the chain on clean installations within hours. As online stores continue to rely on e-commerce platforms like Adobe Commerce and Magento, businesses must prioritize security patches and monitoring for potential exploitation.
Given the severity of this vulnerability, it’s essential for store owners to take immediate action to protect their sites. This includes applying the latest security patches as soon as they become available, closely monitoring email activity for suspicious behavior, and implementing robust logging and alerting mechanisms to detect potential exploitation attempts.
Source: SecurityWeek — 2026-09-07