StyleSmuggler Zero-Day Hits Magento Stores With Stealthy Linux Backdoor
Attackers actively exploit a zero-day vulnerability dubbed StyleSmuggler that affects all versions of Magento and Adobe Commerce. E-commerce security firm Sansec records the first exploitation on September 4 against a target running the latest security updates. Adobe Enterprise Support confirms it is working on a fix but provides no timeline, leaving more than 160,000 websites exposed until a patch arrives.
The exploit abuses Magento's template system through PHP code injection to generate a fake failed-payment email that triggers code execution. Successful attacks install a small Rust-based backdoor as a background process, disguised as a kernel worker thread or as "fc-cache" in newer variants. The malware persists via a cron job that runs every 30 minutes and communicates with remote command-and-control infrastructure, with older samples using TLS/WebSockets and newer ones masquerading as NTP traffic over UDP port 123 to slip past firewalls.
The backdoor also determines the server's public IP using services like ipify and ipinfo.io, and checks Linux's TracerPid value to detect debugging, skipping beaconing if tracing is active while still installing. Sansec advises administrators to watch for surges in "Payment Transaction Failed Reminder" emails, suspicious kworker or fc-cache processes, rogue cron entries, and temporary files, and to rotate Magento credentials if compromise is suspected. With Adobe's next scheduled security release expected on September 8, the company recommends disabling risky functionality until a patch becomes available.