A new unpatched zero-day vulnerability dubbed 'StyleSmuggler' has been discovered in Magento Open Source and Adobe Commerce by Dutch e-commerce security company Sansec. The flaw allows attackers to execute malicious code on online store servers without requiring authentication. Active exploitation began on September 4, 2026, with Sansec publishing an early advisory on September 5. The vulnerability poses a critical risk to e-commerce operators using affected platforms, potentially enabling full server compromise and store backdooring. No patch was available at the time of disclosure, making this a high-severity zero-day threat targeting the e-commerce ecosystem.
A zero-day vulnerability dubbed 'StyleSmuggler' affects Magento Open Source and Adobe Commerce, allowing unauthenticated remote code execution on store servers. The attack operates in two stages: (1) PHP code is planted in a file that Magento writes itself, such as a failure report (var/report/) or var/log/system.log, using a specially crafted request header (X_TRACE_ or X-TRACE- followed by hex characters); (2) Magento is triggered to execute that file via its standard 'Payment Transaction Failed Reminder' email mechanism — no email needs to be opened or even delivered for the exploit to succeed. The injected code abuses Magento's dependency-injection compiler code (files under setup/src/Magento/Setup/Module/Di/Code/) by driving Magento's own classes into code meant solely for CLI use, ultimately including an attacker-controlled file path (the poisoned log). A PHP dropper then attempts six PHP functions (including proc_open) to start a process, downloads, and launches a persistent implant. The implant is a stripped, statically linked Rust binary (~1.9 MB) built for x86-64 and arm64, installed at ~/.local/share/.gvfsd/gvfsd-user. It disguises itself as a Linux kernel thread named [kworker/u:8:0], owned by the site user (not root) with real memory usage. A cron entry written directly to /var/spool/cron/crontabs/ restarts it every five minutes with no log of crontab replacement. On one store the cron line appeared 1,728 times and was re-added within a second of removal. The implant connected to the store's own Redis instance (port 6379) reading Magento session storage. On one store, the binary running in memory differed from the file on disk. The exploit vector is through GraphQL. A stealthier variant returns an empty array leaving nothing in logs. Disrex observed 26 distinct attacker source IPs including bulk-sending hosting infrastructure and a residential proxy pool.
IMMEDIATE MITIGATIONS: (1) Disable GraphQL until Adobe releases an official patch (note: headless/PWA storefronts require GraphQL; most classic and Hyvä storefronts do not). (2) Add proc_open to PHP's disable_functions list. (3) Mount /tmp, /var/tmp, and /dev/shm with the noexec flag to prevent downloaded binaries from executing. (4) Apply Disrex's nginx/Apache WAF rules blocking exploit parameters in URL query strings (note: does not block POST body or JSON body delivery). (5) Apply Disrex's composer patch adding CLI-only guards to three Magento DI code scanner methods (ClassesScanner.php, etc.) — check vendor directory for mageplaza/module-admin-permissions before applying as it may break that module's admin screen. (6) Apply ProxiBlue's unofficial patches (three patches published on GitHub Gist). (7) Apply Graycore's Magento module which hardens the email template block directive, grid row URL generator class check, and breaks PHP opening tags in Web API fatal error reports. DETECTION: (8) Search var/report/ AND var/log/system.log for marker patterns matching X_TRACE_ or X-TRACE- followed by hex characters. (9) Check for processes named [kworker/u:8:0] owned by non-root users with real resident memory. (10) Check /proc/<pid>/exe hash in addition to on-disk file hash. (11) Inspect /var/spool/cron/crontabs/ for suspicious cron entries referencing ~/.local/share/.gvfsd/gvfsd-user or /tmp/.kw_. (12) Check for files at ~/.local/share/.gvfsd/gvfsd-user and associated lock files. (13) Block IOC IPs and domain at network perimeter. (14) Monitor for unexpected bursts of 'Payment Transaction Failed Reminder' emails. (15) Use Sansec eComscan scanner (version 1.9.7+ for Shield customers terminates the process). INCIDENT RESPONSE (if already infected): (16) Preserve forensic evidence first before any cleanup. (17) Remove cron entry BEFORE killing the process (process restores the cron entry). (18) Do NOT reboot — the copy under /proc may be the only remaining binary. (19) Do NOT run composer install during cleanup as it overwrites timestamps. (20) Flush session storage (implant reads Redis session data). (21) Rotate crypt/key in app/etc/env.php. (22) Rotate all admin passwords, payment provider API keys, and integration credentials. (23) Rotate Magento credentials wherever the malicious process has been identified. (24) Await Adobe's official patch (next scheduled release was September 8, 2026).
Process: [kworker/u:8:0] owned by a non-root user, File: ~/.local/share/.gvfsd/gvfsd-user, File: ~/.local/share/.gvfsd/.gvfsd_<8hex>.lock, File: /tmp/.gvfsd_<8hex>.lock, File: /tmp/.kw_<random><random>, Cron: */5 * * * * exec <home>/.local/share/.gvfsd/gvfsd-user, Cron variant pointing at /tmp/.kw_, SHA-256: e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7 (Sansec sample), SHA-256: 8334b434fa3fe9f59cebe9609b11e0b1fd19d10212c45c705adec1902a1d06ef (on-disk, both Disrex stores), SHA-256: 251fabd50d7b18a8b5e1b3ef5d64e7198c17244778f6461fb1ab07f6169bf220 (in-memory, one Disrex store), Domain: 247.cdnflare[.]xyz (malware download host), IP: 99.84.67[.]186:443 (C2 over WebSocket and TLS, per Sansec), IP: 88.216.72[.]181 (attacker source, per Sansec), IP: 5.181.86[.]133 (attacker source sending in bulk, per Disrex), Log marker in var/report/ or var/log/system.log: X_TRACE_ or X-TRACE- followed by hex characters, TypeError from array_merge() with integer argument in system.log immediately after include, Redis connections (port 6379) from non-legitimate process, Unexpected bursts of 'Payment Transaction Failed Reminder' emails
