Author: DigitalSpying Security Desk
Date: September 13, 2026
Executive Summary
A critical wave of zero-day exploitation is sweeping across global e-commerce infrastructure as threat actors weaponize a newly discovered remote code execution vulnerability in Adobe Commerce and Magento Open Source. Dubbed StyleSmuggler and tracked as CVE-2026-75650 with a maximum CVSS rating of 10.0, the exploit allows unauthenticated remote attackers to execute arbitrary server-side PHP commands on merchant storefronts. Uncovered and investigated by cybersecurity firm Sansec, in-the-wild attacks began on September 4, days before Adobe issued emergency advisory APSB26-146 releasing the VULN-39341 standalone hotfix. Threat actors are chaining style attribute injections within Magento's template rendering subsystem with automated payment failure notification flows, dropping stealthy multi-stage Rust implants disguised as legitimate Linux kernel workers (kworker) and NTP daemons (chronyd). With digital skimmers and ransomware syndicates actively exploiting vulnerable stores, merchant organizations face immediate risks of payment card exfiltration and complete server compromise.
Deep-Dive Technical Analysis
1. The StyleSmuggler Injection Primitive (CVE-2026-75650)
* Vulnerability Classification: Improper Control of Generation of Code / Template Injection (CWE-94, CVSS 10.0).
* Affected Architectures: Adobe Commerce and Magento Open Source releases from 2.4.4 up to 2.4.9, as well as B2B modules 1.3.3 to 1.5.3.
* The Core Flaw: Magento relies on an extensive email and layout template engine that processes dynamic directives. While historically secured against direct code execution via strict parameter sanitization, StyleSmuggler abuses the styles properties passed into template objects.
* Bypassing Template Filters: When styling attributes are parsed, the engine improperly evaluates user-controlled style objects without sanitizing embedded PHP execution tags. By smuggling PHP code sequences inside stylesheet parameter declarations (e.g., via POST /graphql?styles[...] or crafted request headers like Store:), adversaries evade existing template security validation filters.
2. The Two-Stage Execution Kill Chain
StyleSmuggler operations follow a structured two-stage attack lifecycle designed to decouple payload delivery from server execution:
Stage 1: Payload Poisoning
The attacker injects serialized PHP shellcode into a server-side storage medium. Common delivery vectors include:
* Generating a diagnostic report file containing encoded PHP snippets within error trace metadata (x_trace_ entries under var/report/).
* Uploading malicious snippets via GraphQL store configuration endpoints (POST /graphql with encoded payloads in the Store: header).
* Storing malicious strings within user session caches or custom product upload fields.
Stage 2: Triggering Execution via Failed Payment Notifications
* Once the payload is staged, the attacker deliberately triggers a failed checkout transaction (e.g., via POST /paypal/transparent/response/).
* Magento's automated workflow initiates a "Payment Transaction Failed Reminder" email notification.
* As Magento's backend template processor compiles and renders the failure email, it parses the poisoned style properties. The PHP interpreter evaluates the injected tags, executing arbitrary commands under the privileges of the web server user (www-data / nginx).
* Crucially: Exploitation succeeds regardless of whether the email is successfully delivered or opened by a human recipient; execution occurs purely during backend template rendering.
Phase
Action
Targeted Subsystem
Initial Access
Dispatches Malformed Request with PHP Snippet in styles / Store Header
Storefront Staging Handler
Staging
Injects Payload into var/report/ or Session Storage
Server-side Storage
Trigger
Initiates "Payment Transaction Failed Reminder" Routine
Automated Workflow Engine
Execution
Evaluates styles Properties During Email Template Rendering
Magento Template Subsystem
Persistence
Spawns Hidden Background Rust Implant or Secondary Web Shell
OS / Web Server Context
3. Post-Exploitation Implants & Evasion Tradecraft
Sansec's forensic telemetry has documented rapidly evolving malware builds deployed immediately following compromise:
* Rust-Based Stealth Backdoors: Attackers drop lightweight, compiled Rust executables into /tmp/ or ~/.cache/ and execute them under deceptive process names:
* [kworker/u:8:0] (mimicking internal Linux kernel worker threads).
* fc-cache (mimicking fontconfig font cache utilities, version 2.1.4).
* chronyd (mimicking legitimate Network Time Protocol service daemons, version 2.1.5).
* Stealth NTP C2 Beaconing: The implants communicate with command-and-control servers (e.g., 185.157.160[.]251, ntp.timesync.to) over UDP/123. The traffic is structured to resemble standard 48-byte NTP datagrams, bypassing traditional outbound corporate firewall egress blocks. However, the datagram payload embeds chunked MessagePack telemetry containing host metadata, disk utilization, and execution privileges.
* Secondary Web Shells: Secondary threat actors have been observed planting authenticated PHP web shells in pub/media/catalog/product/cache/ guarded by custom HTTP headers (X-Cache-Token), maintaining backup access even if main background processes are terminated.
Industry Impact & Magecart E-Commerce Risk
* Payment Card Data Theft (Magecart): With full server-side RCE, attackers inject JavaScript credit card skimmers directly into checkout templates (such as checkout/onepage), harvesting customer credit card numbers, CVVs, and billing details in real time.
* Enterprise Credential Compromise: Full system access enables adversaries to dump Magento's encryption key (env.php), decrypting payment gateway API keys, administrative database passwords, and third-party SaaS integration tokens.
* Mass Vulnerable Footprint: Because in-the-wild attacks operated as an unpatched zero-day from September 4 to September 7, thousands of unpatched e-commerce stores are already running active implants.
Actionable Recommendations & Incident Response Checklist
1. Apply Emergency Vendor Hotfix
Merchants must apply Adobe's official composer hotfix immediately:
* Download patch archive VULN-39341-composer-patches.zip from repo.magento.com.
* Apply the patch via composer and verify successful installation:
vendor/bin/magento-patches -n status | grep "39341\|Status"
* For stores on legacy, out-of-support branches (2.2.0 through 2.4.3), utilize community-backported security patches or deploy strict virtual patching rules on CDN edge layers (such as Cloudflare, Imperva, or Fastly).
2. Comprehensive Forensic Sweep & Indicator Hunting
Because zero-day exploitation preceded patch availability, merchants must perform an immediate compromise assessment:
* Search for Rogue Daemons: Check running processes for disguised kernel or NTP processes:
ps -eo pid,comm,args | grep -iE 'kworker|fc-cache|chronyd'
* Inspect Cron Spool Files: Audit crontabs for hidden cron jobs scheduled in /var/spool/cron/crontabs/ or user crontabs:
crontab -l | grep -iE 'gvfsd|fc-cache|chronyd'
* Sweep Media Directories for Web Shells: Scan image cache paths for unauthorized PHP scripts:
find pub/media -name '*.php'
3. Comprehensive Credential Rotation
If compromise is identified or suspected:
1. Rotate Magento's master crypt_key in app/etc/env.php.
2. Rotate all database passwords, payment gateway merchant API secrets (e.g., Stripe, PayPal, Authorize.Net), and admin user credentials at their external providers.
3. Invalidate active admin sessions and regenerate all REST/OAuth integration tokens.
Sources and Reference Intelligence: Sansec Threat Research, Adobe Security Advisory APSB26-146, NIST National Vulnerability Database.