Magento is installed on more than 160,000 websites — including 14,000 of the top 1 million sites — and a zero‑day vulnerability affecting all versions of Magento and Adobe Commerce is being used in the wild to install a stealthy Linux backdoor, researchers say.
Scope: Magento and Adobe Commerce installations
Security firm Sansec reported that a newly named zero‑day, “StyleSmuggler,” affects all versions of Magento and Adobe Commerce and is actively exploited to deploy a backdoor. The first recorded exploitation occurred on September 4 on a target that Sansec says was running the latest security updates. Adobe Enterprise Support has confirmed it is working on a fix but has not provided a timeline.
Attack chain: template abuse and PHP code injection
Sansec observed the exploit abusing Magento’s template system. The attacker injects PHP code that forces the platform to generate a fake “Payment Transaction Failed Reminder” email — a workflow that, in the observed cases, triggers remote code execution. Sansec warns that an unexpected surge of those failed‑payment reminder emails may be an early sign of exploitation.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleBackdoor behavior: Rust binary, process disguise, cron persistence, and NTP mimicry
Successful exploitation installs a small Rust‑based backdoor that runs as a background process. Early samples were disguised as a kernel worker process named kworker/u:8:0; newer versions impersonate fc-cache, copying the binary to ~/.cache/fontconfig/fc-cache. For persistence, the attacker adds a cron job configured to run every 30 minutes.
Sansec did not observe follow‑on activity in the cases they reviewed, but the malware is capable of communicating with remote infrastructure and receiving commands. Earlier samples used TLS over WebSockets for command‑and‑control (C2). Newer builds attempt to mask their network traffic as Network Time Protocol (NTP): they send UDP packets to port 123 and use hostnames that resemble legitimate time‑sync infrastructure in order to blend with allowed traffic and bypass firewall controls.
The backdoor also performs reconnaissance on the host: it determines the server’s public IP address by querying services including ipify, icanhazip, ident.me, and ipinfo.io, and it inspects Linux’s TracerPid value to detect active debugging or tracing. If tracing is found to be active, the malware still installs but suppresses its beacons.
Adobe Enterprise Support, Sansec guidance, and immediate mitigations
At the time of reporting, Adobe has not released a patch for StyleSmuggler. Adobe’s next scheduled security release is September 8; Sansec says Adobe Enterprise Support confirmed work is underway but offered no timeline for a fix. BleepingComputer contacted Adobe to ask whether a fix is planned for rollout on September 8, and Adobe had not responded.
Sansec’s recommended mitigations until a fix is available include disabling GraphQL on affected sites. They also advise monitoring for indicators of compromise observed in the wild: sudden volumes of “Payment Transaction Failed Reminder” emails, background processes named kworker or fc-cache, suspicious cron entries that run every 30 minutes, and related temporary files. If compromise is suspected, Sansec recommends rotating Magento credentials.
What this means for technologists, website administrators, and Adobe Enterprise Support
- Technologists and security teams: Watch for the behavioral indicators Sansec documented — process names, cron entries, and spikes in failed‑payment reminder emails — and review firewall logs for unusual UDP traffic to port 123 that uses nonstandard hostnames. Treat evidence of exploitation as high priority because the observed toolset includes remote command capability.
- Website administrators and e-commerce operators: If you run Magento or Adobe Commerce, consider temporarily disabling GraphQL where feasible and prepare to rotate credentials if you detect signs of compromise. Note that Sansec recorded at least one successful exploit on a host that had the latest security updates applied.
- Adobe Enterprise Support: The firm has confirmed it is working on a fix but has not provided a timeline; its scheduled September 8 security release is the nearest public milestone. Operators and security teams will be watching that release closely for a definitive patch.
StyleSmuggler combines a low‑profile initial trigger — a fake failed‑payment email — with a compact, disguised Rust backdoor that attempts to hide in normal system process listings and legitimate network flows. With Adobe yet to publish a patch and one confirmed exploitation on a fully updated host, the practical question for administrators is immediate: can detection and containment practices spot the subtle artifacts Sansec describes before that backdoor begins meaningful follow‑on operations?
Source: BleepingComputer — Magento StyleSmuggler zero-day exploited to deploy Linux backdoor
