Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

1. Executive summary

Threat actors are exploiting a zero-day remote code execution flaw — dubbed "StyleSmuggler" by Sansec — in Adobe Commerce and Magento to inject PHP code into the template system and deploy a Rust-based backdoor on compromised stores. Exploitation began on 2026-09-04 and works against Magento 2.4.7, 2.4.8 and 2.4.9, including deployments running the July and August 2026 patches; no fix was available at time of writing, with Adobe's scheduled Patch Tuesday updates due 2026-09-08. The backdoor masquerades as kernel/system processes ([kworker/u:8:0], then fc-cache from 2026-09-06), beacons a C&C server disguised as NTP traffic, and exfiltrates host intelligence including agent ID, hostname, username, resource usage, OS version, uptime, root access and the store's public IP. No verified reference data resolved for this item, so no CVSS score, severity rating or CISA-KEV exploitation state can be stated with authority — treat all figures circulating in vendor copy as unverified. EMEA financial services clients running customer-facing Adobe Commerce/Magento storefronts — including payment-adjacent storefronts — should treat this as an active, in-the-wild compromise vector and hunt immediately.

2. Regulatory framing

No article is cited for the mere existence of a vulnerability; the triggers above are the in-the-wild exploitation, the reproducible chain, and the backdoor/C&C behaviour specific to this campaign.

3. Technical analysis & attack chain

Confirmed attack chain (per Sansec, single-sourced — see caveat)

1. Initial access. Attacker exploits the StyleSmuggler flaw — an RCE in Magento's template system — against Adobe Commerce/Magento 2.4.7, 2.4.8 and 2.4.9. Exploitation does not require user interaction. Deployments running the July and August 2026 patches were successfully exploited, i.e. patching to date does not mitigate.
2. Code injection. PHP code is injected into Magento's template system in two stages: first, the injection is performed by generating a failure report; second, Magento executes the injected code via a failed payment email. Detection evasion is achieved by hiding the payload in the styles properties of the template system.
3. Execution trigger. The malicious code executes when Magento resends the "Payment Transaction Failed Reminder" email and also when email delivery fails. Sansec notes that unexpected bursts of these notification emails are an investigation signal, with the caveat that legitimate declined payments generate the same notification.
4. Backdoor deployment. Successful exploitation deploys a backdoor written in Rust. Two variants observed: from 2026-09-04, disguised as [kworker/u:8:0]; from 2026-09-06, a second version disguised as fc-cache.
5. C&C and data collection. The implant connects to a command-and-control server and awaits commands. C&C traffic is disguised as NTP server replies. Beacon contents include agent ID, hostname, username, memory and disk usage, OS version, uptime, root access status, and implant version. The implant identifies the store's public IP before beaconing.

Technical specifics relevant to defenders

• Affected software: Adobe Commerce and Magento, versions 2.4.7, 2.4.8, 2.4.9. Exploited on deployments current through the August 2026 patch level.
• Vulnerability class: RCE via PHP injection into the template system, with payload concealed in styles properties. Sansec reproduced the chain on clean installations within hours of finding the campaign (2026-09-04, 22:40 UTC).
• Observable side-effect: bursts of "Payment Transaction Failed Reminder" emails beyond expected declined-payment volumes.
• Covert channel: NTP-formatted C&C traffic outbound from the web/storefront host — notable because storefront servers rarely have a legitimate reason to originate NTP client sessions to arbitrary internet hosts.
• Process masquerading: implant binaries/processes named to imitate kernel workers ([kworker/u:8:0]) and the fontconfig cache utility (fc-cache).

CVE note and discrepancies. The related GitHub advisories (GHSA-cv9f-fh36-ww7h, GHSA-5g6h-388x-r7r7) describe Adobe Commerce "Incorrect Authorization" vulnerabilities — one enabling a low-privileged attacker to bypass security measures and gain unauthorised read/write access with limited availability disruption, the other unauthorised read access — and corpus-1 references exploitation of "CVE-2026-71362" shortly after Adobe released patches. However, the primary Sansec-sourced reporting does not assign a CVE identifier to StyleSmuggler, and no verified reference data resolved for this item, so we cannot confirm which CVE (if any) maps to StyleSmuggler, nor any CVSS score or CISA-KEV state. Do not conflate the GHSA authorisation-bypass advisories with StyleSmuggler without vendor confirmation.

Confidence caveat. The entire technical picture — chain, versions, backdoor behaviour, C&C protocol — rests on a single vendor (Sansec) as relayed by SecurityWeek. Single-sourced; verify before enforcement. Attribution to any named actor: none offered in the source material, so attribution is unconfirmed/unknown.

4. Mitigation & containment

No vendor fix for StyleSmuggler was confirmed at time of writing; Adobe's scheduled Patch Tuesday updates were expected 2026-09-08, but SecurityWeek stated it was unclear whether StyleSmuggler would be addressed in that cycle. Containment therefore leans on detection and hardening until a patch is confirmed.

P1 — within 24 hours

1. Inventory: enumerate all internet-facing Adobe Commerce/Magento instances, specifically 2.4.7/2.4.8/2.4.9, including those at July/August 2026 patch levels — these are confirmed exploitable.
2. Hunt for the implant: on Commerce/Magento hosts, look for processes/binary names [kworker/u:8:0] and fc-cache that are not legitimate (a real kernel worker is not a userspace file; a real fc-cache is the fontconfig utility — check binary path and parent process). Rust binaries of unexpected provenance in web-writable directories are prime suspects.
3. Hunt for the injection: review Magento template data and failure-report generation for injected PHP, paying attention to content hidden in styles properties. Sansec reproduced the chain on clean installs, so a test against a staging copy is feasible.
4. Egress control: restrict or monitor outbound NTP (UDP/123) from storefront/Commerce servers to non-approved time sources; the C&C channel is disguised as NTP replies. Flag NTP sessions to unfamiliar destinations.
5. Monitor the trigger: alert on anomalous volumes of "Payment Transaction Failed Reminder" emails, and on email-delivery-failure resend events from the Commerce host.

P2 — within 72 hours

6. Patch posture: apply Adobe's 2026-09-08 Patch Tuesday releases to Commerce/Magento as soon as available, then confirm with Adobe/vendor bulletins whether StyleSmuggler is actually fixed — the source explicitly says this was unclear. Do not assume the September cycle closes it.
7. Web application firewall / virtual patching: where a WAF fronts the storefront, work with the vendor for a virtual patch or request-signature coverage for the failure-report/template-injection pattern; validate against a staging instance.
8. File-integrity review: baseline and diff Magento application and template directories for unexpected PHP modifications and new binaries; the payload executes through the template system and email-resend path.
9. Contain any confirmed compromise: isolate affected hosts, capture memory and the implant binary for analysis, rotate credentials accessible to the web tier, and review whether the store's public IP/host telemetry was beaconed (it was collected pre-beacon per Sansec).

P3 — within 7 days

10. Harden the email path: review whether "Payment Transaction Failed Reminder" resend and delivery-failure handling can be disabled or rate-limited if not business-critical, since both trigger execution.
11. Least privilege on the web tier: confirm the Commerce runtime user has no root/sudo; the implant reports "root access" status, implying privilege level is of interest to the operator.
12. Third-party storefront providers: if storefronts are operated by an agency or SaaS commerce provider, request written confirmation of their patch and compromise-check status (see DORA Art. 28/30 obligations in your third-party programme).

5. Indicators of compromise

No atomic indicators (hashes, domains, IPs, URLs) are present in the source material. The sources describe observable behaviours only.

Behavioural indicators

6. Detection

rule AT_Backdoor_StyleSmuggler_Implant
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-07"
        reference = "https://www.securityweek.com/adobe-commerce-zero-day-exploited-to-backdoor-online-stores/"
        description = "Detects the Rust-based StyleSmuggler backdoor masquerading as [kworker/u:8:0] or fc-cache on Adobe Commerce/Magento hosts. Based on process/binary names reported by Sansec; no file hashes available in source material."
    strings:
        $name1 = "[kworker/u:8:0]" ascii
        $name2 = "fc-cache" ascii
    condition:
        1 of them
}

Note the limitation: the source provides only the two masquerading names, no embedded strings, mutexes or hard-coded C&C values, so this rule is name-based and will also match legitimate fc-cache (fontconfig) binaries. Use it as a triage signal on Commerce/Magento web tiers, not as a standalone verdict; validate any hit by binary path, parent process and network behaviour (NTP-formatted egress).

title: Suspicious process masquerading as kernel worker or fc-cache on Adobe Commerce/Magento host
id: 00000000-0000-0000-0000-000000000767
status: experimental
description: Detects the StyleSmuggler backdoor process names reported by Sansec ([kworker/u:8:0], fc-cache) on hosts running Adobe Commerce/Magento 2.4.7-2.4.9.
references:

    - https://www.securityweek.com/adobe-commerce-zero-day-exploited-to-backdoor-online-stores/
author: Adverse Trace
date: 2026-09-07
logsource:
    category: process_creation
    product: linux
detection:
    selection_name:
        Image|endswith:

            - '/fc-cache'
        CommandLine|contains:

            - '[kworker/u:8:0]'
            - 'fc-cache'
    filter_legit_fc_cache:
        Image|startswith:

            - '/usr/bin/'
            - '/usr/sbin/'
            - '/bin/'
    condition: selection_name and not filter_legit_fc_cache
falsepositives:

    - Legitimate fontconfig fc-cache invocations (validate path and parent process)
    - Kernel worker strings in monitoring tooling output
level: high

7. Sources

• SecurityWeek — Adobe Commerce Zero-Day Exploited to Backdoor Online Stores — https://www.securityweek.com/adobe-commerce-zero-day-exploited-to-backdoor-online-stores/ — 2026-09-07
• SecurityWeek — Adobe Commerce Bug Targeted Immediately After Disclosure — https://www.securityweek.com/adobe-commerce-bug-targeted-immediately-after-disclosure/ — (corpus, undated in provided material)
• GitHub Security Advisory GHSA-cv9f-fh36-ww7h — Adobe Commerce Incorrect Authorization (read/write bypass) — https://github.com/advisories/GHSA-cv9f-fh36-ww7h — (corpus, undated in provided material)
• GitHub Security Advisory GHSA-5g6h-388x-r7r7 — Adobe Commerce Incorrect Authorization (read bypass) — https://github.com/advisories/GHSA-5g6h-388x-r7r7 — (corpus, undated in provided material)

8. Adverse Trace position

Severity cannot be scored against verified reference data — none resolved for this item — but the operational picture is unambiguous: an unpatched, in-the-wild RCE chain with a working backdoor, effective against current patch levels of a widely deployed e-commerce platform, reproduced on clean installs within hours. For EMEA financial services, the direct exposure is any customer-facing or payment-adjacent storefront running Adobe Commerce/Magento 2.4.7–2.4.9; the indirect exposure is brand and fraud risk if a storefront is backdoored while handling customer sessions. All technical detail is single-sourced (Sansec via SecurityWeek) — verify before enforcement — and no actor attribution is offered, so treat attribution as unknown. We will monitor Adobe's 2026-09-08 Patch Tuesday release for confirmation of a StyleSmuggler fix, update this advisory with CVE/CVSS/KEV data once verified reference data resolves, and enrich the IOC set as independent reporting emerges.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.