GoKawiilUnpatched Magento flaw 'StyleSmuggler' used to install Linux backdoor on e-commerce sites
Security firm Sansec has detected active exploitation of an unpatched vulnerability, dubbed StyleSmuggler, affecting all versions of Magento and Adobe Commerce. Attackers inject PHP code through the platform's template system by triggering a fake failed-payment email, which then installs a Rust-based backdoor disguised as a legitimate Linux process and sets up a cron job for persistence. Adobe has confirmed it is working on a patch but has not given a release date.
GoKawiil's interpretation of the reporting above, not reported fact.
Magento powers over 160,000 online stores, including 14,000 among the world's top million sites, making this a high-value target for attackers seeking payment data or persistent access. The backdoor's use of NTP-mimicking traffic and anti-tracing checks shows a deliberate effort to evade detection, meaning infected stores could remain compromised long after the initial breach without visible signs beyond unusual system emails.
- StyleSmuggler is an unpatched zero-day affecting all Magento and Adobe Commerce versions.
- Exploitation installs a stealthy Rust backdoor disguised as system processes and communicates via fake NTP traffic.
- Site operators should watch for unusual spikes in 'Payment Transaction Failed' emails as a possible sign of compromise.
No Starch Press "Linux Basics for Hackers" (Book) — When attackers hide a Rust backdoor as a fake kworker process and sneak in a cron job, knowing your way around Linux internals is what saves you. This No Starch Press guide walks through processes, cron, networking and log inspection from the ground up, making it a solid companion for anyone administering a Magento server or hunting for suspicious background tasks.
See No Starch Press "Linux Basics for Hackers" (Book) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-07
Published there as: “Magento StyleSmuggler zero-day exploited to deploy Linux backdoor”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.