StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack

Sansec discovered StyleSmuggler, an unpatched Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. All current versions are affected, including 2.4.9. Attacks started September 4th. Sansec is rolling out emergency mitigation.

StyleSmuggler injects malicious code into Magento's template system. By using the styles properties, it can evade existing safeguards. It works in two stages:

Inject (poison) PHP code, for example by generating a failure report.

Let Magento execute the poisoned code via a failed payment email

Sansec reproduced the full unauthenticated chain on clean Magento Open Source 2.4.7, 2.4.8 and 2.4.9 . The first victim ran 2.4.6-p15 with the July and August 2026 patches applied and security:patch-status clean.

What merchants should do

Block attacks : Deploy Sansec Shield to block StyleSmuggler exploitation in real time.

Scan for compromise : Run eComscan to detect the implant and any secondary backdoors.

If you are not using Sansec Shield, you can temporarily disable Graphql until Adobe has released an official fix. The Adobe security release is scheduled for Sept 8th, but it is yet unknown if that covers this bug.

A solid indicator is a malicious background process, disguised as [kworker/u:8:0] :

Failed payment emails

StyleSmuggler deliberately triggers Magento's standard “Payment Transaction Failed Reminder” email. Unexpected bursts of these messages are a reason to investigate, although legitimate declined payments can generate the same notification. Nobody needs to open the email because the malicious code runs while Magento renders it. The attack can also succeed when email delivery fails, so receiving no message does not mean the store is safe.

Sansec found the campaign on September 4th, 22:40 UTC and reproduced the chain on clean installations within hours. Sansec Shield rules went live in the early morning of September 5th. Shield has blocked StyleSmuggler exploitation attempts since then, and refined rules covering both stages are rolling out now.

Sansec Shield customer? Attacks that were launched before our Shield release may have gotten through. Our investigation shows that in these cases a background process [kworker/u:8:0] was launched. We have released eComscan 1.9.7 that will terminate these processes for Shield customers. While we have no indication that the backdoor was actually used, we recommend to rotate Magento credentials if a suspicious process has surfaced on your system.

Indicators of compromise

A full breakdown of the gadget chain, the dropper and the implant follows in an update.

PolyShell: unrestricted file upload in Magento and Adobe Commerce

SessionReaper attacks have started, 3 in 5 stores still vulnerable

SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025-54236)

Persistent backdoors injected on Adobe Commerce via new CosmicSting attack

Mass PolyShell attack wave hits 471 stores in one hour

Block all known Magento attacks, while you schedule the latest critical patch until a convenient moment. No more downtime and instability from rushed patching.

Scan your store now for malware & vulnerabilities

eComscan is the most thorough security scanner for Magento, Adobe Commerce, Shopware, WooCommerce, Sylius and many more.