Adobe Commerce Zero-Day Exploited to Backdoor Online Stores
Sansec found attackers exploiting an Adobe Commerce/Magento zero-day (StyleSmuggler) since September 4 to deploy Rust backdoors on online stores.
Threat actors are actively exploiting a zero-day RCE in Adobe Commerce and Magento 2.4.7-2.4.9, injecting PHP code via generated failure reports and executing it through Magento's payment-failure email, with no user interaction required. Exploitation began September 4 and succeeds even against stores running the July and August 2026 patches; the Rust backdoor disguises itself as kworker/u:8:0 or fc-cache and hides C&C communication inside fake NTP replies. Adobe's September 8 Patch Tuesday updates may not include a StyleSmuggler fix.
- StyleSmuggler exploits template 'styles' properties to inject PHP and evade detection
- Backdoor written in Rust, beacons via NTP-disguised traffic with host details
- Exploitation started September 4; second backdoor variant emerged September 6
- Affects Magento 2.4.7, 2.4.8, 2.4.9 including latest patches
- Sudden bursts of 'Payment Transaction Failed Reminder' emails indicate possible compromise
- Products
- Adobe CommerceMagento
- Malware
- StyleSmuggler
- Victims
- online stores
From the original article
2 min read at securityweek.com
The StyleSmuggler zero-day allows attackers to execute code and deploy a stealthy backdoor on Adobe Commerce and Magento stores. The post Adobe Commerce Zero-Day Exploited to Backdoor Online Stores appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.