Sansec described StyleSmuggler: an unpatched gap in Magento Open Source and Adobe Commerce that lets an attacker run code on the server without logging in. First confirmed use: 4 September 2026. Public analysis: 5 September. As of 7 September Adobe had not published a fix for this gap. Adobe's next security bulletin is scheduled for 8 September. There is no confirmation that it will cover StyleSmuggler.

Fact source: Sansec analysis. This post summarises the operational impact and a checklist for the store operator.

Which versions are affected

Sansec reproduced the full unauthenticated chain on clean Magento Open Source 2.4.7, 2.4.8 and 2.4.9. The first known victim ran 2.4.6-p15 with the July and August 2026 patches. security:patch-status was clean.

A current version and a green patch status do not protect against StyleSmuggler until there is an Adobe fix or an effective mitigation at the entry.

How the attack chain looks

The gap sits in the template system. The styles properties let malicious PHP in and bypass existing safeguards. Sansec describes two stages:

  • Inject PHP code, for example through a crafted failure report.
  • Execute that code while Magento renders the standard failed-payment message.

In traffic you see among others POST /graphql with styles parameters and payment-related paths, including /paypal/transparent/response/. The attack deliberately triggers the “Payment Transaction Failed Reminder” mail. The code runs while the message is generated. Nobody needs to open the mail. The attack can also succeed when mail delivery fails.

A sudden rise in such mails is a reason to investigate. Receiving no mail does not mean the store is clean.

What remains after a successful attack

After RCE a Rust implant appears on the server. It connects to C2 and waits for commands. As of 7 September Sansec had not confirmed further use of the implant on victims. Persistent access alone is enough to treat this as an incident.

The first process variant pretends to be [kworker/u:8:0]. From 6 September an fc-cache variant appears: a copy under ~/.cache/fontconfig/fc-cache, a cron at minutes 13 and 43, UDP traffic on port 123 to domains that look like time servers (ntp.timesync.to and similar). The traffic looks like time sync. The packets carry hostname, user, OS version and resource use, among other fields.

On 7 September Sansec also described a second, separate actor on the same victims: a short PHP dropper and a web shell in the product image cache, under a path like pub/media/catalog/product/cache/ss_<10hex>/sync_<10hex>.php. Killing the background process does not finish the case. There should be no PHP files under media.

What to do now

Until Adobe ships an official fix, you limit the vector and check whether the store was already compromised, in parallel.

Mitigation. Sansec points to Shield or temporarily disabling GraphQL until a fix. Disabling GraphQL on a headless store or a front that depends on GraphQL can stop sales. Then you decide with the application developers. At the edge it is worth blocking known patterns: POST /graphql with styles, and the payment paths actively used in the campaign as described by Sansec and hosters. A WAF limits entry. It does not replace a Magento patch.

Scan for compromise. On the Magento host you can run our IoC script (no exploit, only signals from the Sansec analysis):

curl -fsSL https://opselis.pl/scripts/stylesmuggler-check.sh -o stylesmuggler-check.sh
chmod +x stylesmuggler-check.sh
./stylesmuggler-check.sh /path/to/magento

Or by hand:

crontab -l | grep -i gvfsd
ls -la ~/.local/share/.gvfsd/ ~/.cache/fontconfig/fc-cache /tmp/.kw_* /tmp/.cache_* /tmp/.gvfsd-* /tmp/.fc-*/fc-cache /tmp/fc-cache 2>/dev/null
ps -eo pid,comm,args | grep -iE 'kworker|fc-cache'
grep -ril 'x_trace_' var/report/
find pub/media -name '*.php'

Also check outbound UDP/123 from the application server and the IoCs from the Sansec analysis: C2 domains and addresses, paths under /tmp, cron, and processes [kworker/u:8:0] and fc-cache.

If you find the implant. Treat it as an incident: isolation, rotate Magento passwords and keys, review cron, media, reports and logs from 4 September, establish the access scope. Killing one process does not remove persistence.

Store layers: security. Magento operations: ecommerce.

In short: StyleSmuggler is unauthenticated RCE, already in use, with no official Adobe fix as of 7 September 2026. First mitigation and a scan for the implant. Then the vendor patch when it lands.