StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack

StyleSmuggler injects malicious code into Magento's template system. By using the styles properties, it can evade existing safeguards. It works in two stages:

1. Inject (poison) PHP code, for example by generating a failure report.
2. Let Magento execute the poisoned code via a failed payment email

Affected versions

Sansec reproduced the full unauthenticated chain on clean Magento Open Source 2.4.7, 2.4.8 and 2.4.9. The first victim ran 2.4.6-p15 with the July and August 2026 patches applied and security:patch-status clean.

What merchants should do

1. Block attacks: Deploy Sansec Shield to block StyleSmuggler exploitation in real time.
2. Scan for compromise: Run eComscan to detect the implant and any secondary backdoors.

If you are not using Sansec Shield, you can temporarily disable Graphql until Adobe has released an official fix. The next Adobe security release is scheduled for Sept 8th, but it is yet unknown if that covers this bug.

Check your store

A solid indicator is a malicious background process, disguised as [kworker/u:8:0]:

crontab -l | grep -i gvfsd
ls -la ~/.local/share/.gvfsd/ /tmp/.kw_* /tmp/.gvfsd-* 2>/dev/null
ps -eo pid,comm,args | grep -i kworker
grep -rl 'X_TRACE_' var/report/

Failed payment emails

StyleSmuggler deliberately triggers Magento's standard “Payment Transaction Failed Reminder” email. Unexpected bursts of these messages are a reason to investigate, although legitimate declined payments can generate the same notification. Nobody needs to open the email because the malicious code runs while Magento renders it. The attack can also succeed when email delivery fails, so receiving no message does not mean the store is safe.

Sansec response

Sansec found the campaign on September 4th, 22:40 UTC and reproduced the chain on clean installations within hours. Sansec Shield rules went live in the early morning of September 5th. Shield has blocked StyleSmuggler exploitation attempts since then, and refined rules covering both stages are rolling out now.

Sansec Shield customer? Attacks that were launched before our Shield release may have gotten through. Our investigation shows that in these cases a background process [kworker/u:8:0] was launched. We have released eComscan 1.9.7 that will terminate these processes for Shield customers. While we have no indication that the backdoor was actually used, we recommend to rotate Magento credentials if a suspicious process has surfaced on your system.

Indicators of compromise

247.cdnflare.xyz                    malware download host
99.84.67.186:443                    C2, WebSocket over TLS
88.216.72.181                       attacker source, seen at multiple victims

sha256  e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7

/tmp/.kw_<random><random>
~/.local/share/.gvfsd/gvfsd-user
~/.local/share/.gvfsd/.gvfsd_<8hex>.lock
crontab: */5 * * * * exec <home>/.local/share/.gvfsd/gvfsd-user
process [kworker/u:8:0]


POST /paypal/transparent/response/?<?=eval(base64_decode('....
GET /customer/section/load/?sections=customer&force_new_section_timestamp=true
POST /graphql?styles[....]=

Timeline

A full breakdown of the gadget chain, the dropper and the implant follows in an update.

Read more

• PolyShell: unrestricted file upload in Magento and Adobe Commerce
• SessionReaper attacks have started, 3 in 5 stores still vulnerable
• SessionReaper, unauthenticated RCE in Magento & Adobe Commerce (CVE-2025-54236)
• Persistent backdoors injected on Adobe Commerce via new CosmicSting attack
• Mass PolyShell attack wave hits 471 stores in one hour