Sansec discovered StyleSmuggler, an unpatched Magento and Adobe Commerce zero-day that gives unauthenticated attackers remote code execution. All current versions are affected, including 2.4.9. Attacks started September 4th. Sansec is rolling out emergency mitigation.
StyleSmuggler injects malicious code into Magento’s template system. By using the styles properties, it can evade existing safeguards. It works in two stages:
- Inject (poison) PHP code, for example by generating a failure report.
- Let Magento execute the poisoned code via a failed payment email
Affected versions
Sansec reproduced the full unauthenticated chain on clean Magento Open Source 2.4.7, 2.4.8 and 2.4.9. The first victim ran 2.4.6-p15 with the July and August 2026 patches applied and security:patch-status clean.
What merchants should do
- Block attacks: Deploy Sansec Shield to block StyleSmuggler exploitation in real time.
- Scan for compromise: Run eComscan to detect the implant and any secondary backdoors.
If you are not using Sansec Shield, you can temporarily disable Graphql until Adobe has released an official fix. The next Adobe security release is scheduled for Sept 8th, but it is yet unknown if that covers this bug.
Check your store
A solid indicator is a malicious background process, disguised as [kworker/u:8:0]:
crontab -l | grep -i gvfsd
ls -la ~/.local/share/.gvfsd/ /tmp/.kw_* /tmp/.gvfsd-* 2>/dev/null
ps -eo pid,comm,args | grep -i kworker
grep -rl 'X_TRACE_' var/report/
Sansec response
Sansec found the campaign on September 4th, 22:40 UTC and reproduced the chain on clean installations within hours. Sansec Shield rules went live in the early morning of September 5th. Shield has blocked StyleSmuggler exploitation attempts since then, and refined rules covering both stages are rolling out now.
Sansec Shield customer? Attacks that were launched before our Shield release may have gotten through. Our investigation shows that in these cases a background process [kworker/u:8:0] was launched. We have released eComscan 1.9.7 that will terminate these processes for Shield customers. While we have no indication that the backdoor was actually used, we recommend to rotate Magento credentials if a suspicious process has surfaced on your system.
Indicators of compromise
247.cdnflare.xyz malware download host
99.84.67.186:443 C2, WebSocket over TLS
88.216.72.181 attacker source, seen at multiple victims
sha256 e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7
/tmp/.kw_<random><random>
~/.local/share/.gvfsd/gvfsd-user
~/.local/share/.gvfsd/.gvfsd_<8hex>.lock
crontab: */5 * * * * exec <home>/.local/share/.gvfsd/gvfsd-user
process [kworker/u:8:0]
POST /paypal/transparent/response/?<?=eval(base64_decode('....
GET /customer/section/load/?sections=customer&force_new_section_timestamp=true
POST /graphql?styles[....]=
Timeline
| Date | Event |
|---|---|
| 2026-09-04 22:20 | First confirmed StyleSmuggler exploitation |
| 2026-09-04 23:10 | eComscan flags the implant on unrelated stores |
| 2026-09-05 | Sansec reproduces the chain on clean 2.4.7, 2.4.8 and 2.4.9 |
| 2026-09-05 07:15 | Sansec Shield starts blocking StyleSmuggler attacks |
| 2026-09-05 | Sansec publishes this analysis |
| 2026-09-08 | Adobe’s next scheduled security bulletin |
A full breakdown of the gadget chain, the dropper and the implant follows in an update.
contact me for secure your store : https://jigneshchabhadiya.com/contact-us/
ref: StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack | Sansec