Magento E-commerce Platform Hit with Zero-Day Vulnerability, Linux Backdoor Deployed
In a worrying development for e-commerce security, a zero-day vulnerability dubbed “StyleSmuggler” has been exploited to deploy a Linux backdoor on websites running Magento and Adobe Commerce. The vulnerability affects all versions of the popular open-source e-commerce platform, which is installed on over 160,000 websites worldwide.
Magento’s template system is being abused through PHP code injection to generate a fake “failed-payment” email that triggers code execution. Once exploited, a small Rust-based backdoor is installed as a background process, disguised as [kworker/u:8:0] or fc-cache depending on the version of Magento. The attacker also adds a cron job configured to repeat every 30 minutes for persistence.
The malware can communicate with remote infrastructure and receive commands, although Sansec researchers did not observe any follow-on activity in the samples they analyzed. However, the attackers have been using various techniques to disguise their traffic as legitimate Network Time Protocol (NTP) communications, making it harder to detect. They send UDP packets to port 123 and use hostnames that resemble time-syncing infrastructure.
Sansec, an e-commerce security company, has observed an unexpected surge of Magento “Payment Transaction Failed Reminder” emails in targeted attacks, which may indicate exploitation. The researchers recommend monitoring for suspicious processes such as ‘kworker’ or ‘fc-cache’, cron entries, and temporary files. If there is suspicion of compromise, it’s recommended to rotate Magento credentials.
Adobe has not released fixes for StyleSmuggler yet, but the firm’s next scheduled security release is tomorrow, September 8. In the meantime, Sansec recommends disabling GraphQL as a mitigation measure. It’s essential for website administrators to be vigilant and take immediate action if they suspect their site has been compromised.
This incident highlights the importance of keeping software up-to-date and implementing robust security measures to prevent zero-day vulnerabilities from being exploited. Website owners should stay informed about any new patches or updates released by Adobe and apply them as soon as possible to ensure the security of their online store.
If you’re running a Magento website, it’s crucial to be aware of these developments and take proactive steps to protect your site. Keep an eye out for suspicious activity, such as unusual email notifications or strange system processes, and consider implementing additional security measures like monitoring and anomaly detection tools to stay ahead of potential threats.
Source: Bleeping Computer — 2026-09-07