Loading story…
Attackers are actively exploiting StyleSmuggler, an unpatched unauthenticated remote-code-execution chain in Magento Open Source that may also affect Adobe Commerce. The attack injects malicious PHP through Magento template style properties, poisoning a log or report file before triggering its execution through the Payment Transaction Failed Reminder email-rendering path. Sansec reproduced the chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 systems, while a confirmed victim ran fully patched 2.4.6-p15.
Following execution, attackers install a persistent Linux implant using cron and masquerade processes as kworker. Reported indicators include download host 247.cdnflare.xyz, WebSocket-over-TLS C2 endpoint 99.84.67.186:443, and artifacts under ~/.local/share/.gvfsd/ and /tmp/.kw_*. No vendor CVE, patch, or formal workaround was available at the time of reporting; organizations should investigate Magento hosts for compromise, apply layered web controls, consider disabling GraphQL where feasible, and rotate session and application credentials on potentially affected deployments.
See which actors are running it and whether you're in range.
18 events from the most recent confirmed update back to the earliest known activity.
CISA added the actively exploited StyleSmuggler vulnerability, CVE-2026-75650, to its Known Exploited Vulnerabilities catalog. The flaw affects Adobe Commerce, Adobe Commerce B2B, and Magento Open Source.
The Canadian Centre for Cyber Security published advisory AV26-888 covering the actively exploited Adobe Commerce, Adobe Commerce B2B, and Magento Open Source flaw. The notice identified affected version ranges and advised applying Adobe's hotfix or updates, while inconsistently referring to the issue as CVE-2026-7565 and CVE-2026-75650.
Adobe PSIRT received the report for CVE-2026-75650 on September 7, 2026. Adobe published advisory APSB26-146 for the unauthenticated Adobe Commerce template-engine flaw, which permits arbitrary code execution as the current user.
Adobe was reportedly working on a patch for the actively exploited StyleSmuggler vulnerability as of September 7, though no release date was confirmed and no patch had yet been issued.
Sansec observed a second Rust-based StyleSmuggler backdoor variant masquerading as fc-cache. The implant disguised command-and-control traffic as NTP replies and collected host and public-IP information before beaconing.
Sansec Shield began blocking observed StyleSmuggler exploitation attempts at 07:15 on September 5, 2026, providing a vendor-operated protective control while the vulnerability remained unpatched.
Sansec publicly reported that the actively exploited unauthenticated StyleSmuggler RCE affects Magento Open Source and Adobe Commerce, including current Magento releases through 2.4.9. Adobe had not issued a CVE, advisory, official patch, or workaround as of September 6.
Disrex Group responded to two compromised Magento stores and identified a third that had been attacked but not breached. Its investigation documented poisoned system.log files, evolving attacker headers, direct cron-file persistence, and additional malware hashes and attack-source indicators.
By 23:10, Sansec detected the StyleSmuggler implant on unrelated stores, indicating the activity was not limited to the first confirmed victim. The implant used cron persistence and masqueraded as a kworker process.
Sansec found the active campaign and reproduced the complete unauthenticated attack chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 installations within hours. The research established that current Magento Open Source releases were exploitable despite existing safeguards.
Sansec recorded the first confirmed StyleSmuggler exploitation at 22:20 against a Magento 2.4.6-p15 store that had July and August 2026 security patches applied. The unauthenticated chain poisoned Magento-managed files and led to remote code execution and backdoor deployment.
Disrex documented that StyleSmuggler can drive Magento DI compiler scanner classes to include attacker-selected poisoned log or report files, executing injected PHP. It released and verified a source-level guard for Magento 2.4.6–2.4.9 that blocks those scanner sinks during HTTP requests while retaining CLI compilation functionality.
Imperva reported a separate campaign using CVE-2026-75650 to deploy PHP web shells, indicating multiple threat actors are attempting to operationalize StyleSmuggler. It also observed largely automated exploitation attempts targeting sites in 15 countries.
The Australian Cyber Security Centre issued an alert on CVE-2026-75650 and said it was aware of a substantial number of potentially vulnerable instances in Australia.
Adobe hotfix APSB26-146 was reported as available for the unauthenticated template-engine RCE affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source. The reference also reports Adobe confirmed active exploitation and assigned the flaw its highest Priority Rating 1.
Sansec published indicators of compromise for StyleSmuggler, including suspicious PHP files in Magento media directories and unusually high volumes of "Payment Transaction Failed Email" messages. It recommended temporarily disabling GraphQL where feasible and investigating affected systems while awaiting a vendor patch.
Sansec analyzed a 485-byte PHP dropper on affected stores that writes a header-protected web shell under the Magento product-image cache. It assessed this tooling as apparently unrelated to the StyleSmuggler implant and could not determine whether the separate actor gained access through StyleSmuggler or another route.
Disrex Group, ProxiBlue, and Graycore published unofficial hardening patches targeting affected Magento classes and email-template functions. Disrex cautioned that its rules block the observed attack pattern rather than remediate the underlying vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 55 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
40 references tracked. Mallory keeps watching after this page renders.
reddit.com
Open sourcefortbridge.co.uk
Open sourceimperva.com
Open sourcetriskelelabs.com
Open sourcesansec.io
Open sourcegithub.com
Open sourcecirt.gy
Open sourcecirt.gy
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors conducted a mass exploitation campaign against **Magento** e-commerce deployments by abusing **CVE-2025-54236** (aka **SessionReaper**), an authentication/session management flaw that allows attackers to bypass login controls by **reusing improperly invalidated session tokens**. Reporting based on an **Oasis Security** investigation described large-scale scanning that identified **1,000+ exposed/vulnerable Magento Commerce APIs** and confirmed compromises of **200+ websites** (with one count citing **216 victim sites**), indicating broad weaponization by multiple actors across regions. After hijacking valid admin sessions via replayed “zombie” tokens, intruders escalated privileges to achieve **root-level control** of affected Linux servers, enabling follow-on actions such as deploying **web shells** for persistent remote command execution and full administrative takeover of storefront infrastructure. Separately, research on **eSkimming/Magecart** activity highlighted that browser-based JavaScript payment-card theft remains persistent across e-commerce sites—often via third-party script/supply-chain compromise—and a longitudinal study of **550** previously compromised sites found **18%** still infected a year later, underscoring that e-commerce compromises frequently involve durable footholds and re-compromise even after initial cleanup.
Jun 29, 2026
A critical vulnerability in the Magento ecommerce platform, identified as CVE-2025-54236 and dubbed 'SessionReaper,' has been actively exploited in the wild. The flaw allows attackers to hijack user sessions and achieve unauthenticated remote code execution (RCE) on affected Magento installations. Security researchers observed a surge in exploitation attempts following the public release of a proof-of-concept (PoC) exploit, with attackers deploying web shells and conducting reconnaissance using classic PHP probes. Adobe released an emergency patch for the vulnerability, and organizations are urged to apply it immediately to mitigate risk. Magento's widespread use and history of critical vulnerabilities make this flaw particularly attractive to threat actors. Exploitation attempts have targeted over 130 hosts from multiple IP addresses within 48 hours of the PoC's publication. Web application firewalls, such as Akamai's Adaptive Security Engine, have been effective in mitigating some exploit attempts by default. The vulnerability's critical nature and active exploitation highlight the urgent need for patching and enhanced monitoring of Magento deployments.
Jun 29, 2026
Adobe disclosed **CVE-2024-34102**, a critical (CVSS 9.8) pre-authentication XML external entity (XXE) flaw in Adobe Commerce and Magento. The vulnerability lies in recursive REST API deserialization and can be reached through an unauthenticated guest-cart shipping-estimation endpoint, allowing attacker-controlled data to instantiate `SimpleXMLElement` objects and retrieve local or remote resources. An attacker could use the flaw to read Magento's `app/etc/env.php`, exposing the installation's cryptographic key and potentially enabling forged administrator JWTs for privileged Magento API access. Research further indicates the issue could be chained with PHP filter techniques and **CVE-2024-2961** toward remote code execution; organizations should apply Adobe's security update, as early third-party emergency mitigations were bypassable and later revised.
Sep 3, 2026