A new unauthenticated exploitation campaign nicknamed StyleSmuggler targets unpatched Magento Open Source and Adobe Commerce installations, allowing attackers to run arbitrary code on a store’s server and install a persistent backdoor without logging in. Sansec, which uncovered and named the flaw, began observing attacks on 4 September 2026. Adobe has not issued an advisory or patch as of 6 September, and its security bulletin index has no record of this issue beyond the August 2026 updates.
The compromise gives attackers code execution on the server; Sansec warns that all active Magento/Adobe Commerce versions are affected and that the researchers have reproduced the unauthenticated chain on Magento Open Source installations of 2.4.7, 2.4.8 and 2.4.9. One observed victim was running 2.4.7-p15 with Adobe’s July and August 2026 updates applied, a patch level Adobe lists as 2.4.6-2026-aug in its history.
The investigation provides technical indicators of compromise and suspected attack mechanics. The backdoor is described as a background process disguised as a Linux kernel thread name [kworker/u:8:0], with a Rust-based implant stored under a user’s home directory and a five-minute cron trigger. Initial stages plant PHP code in a file Magento may write (for example in a failure-reporting flow) and then elicit execution by triggering Magento’s “Payment Transaction Failed Reminder” email.
The implants contact a remote download host and C2, with several IoCs published by Sansec and independent researchers (including specific file paths, cron entries, and SHA-256 hashes) and a recommendation to disable GraphQL temporarily for Shield customers. Respondents note there is no vendor fix yet; mitigation remains experimental, with community patches and server-hardening steps proposed.