StyleSmuggler Zero-Day Enables Unauthenticated RCE in Magento Stores

Attackers are actively exploiting StyleSmuggler, an unpatched unauthenticated remote-code-execution chain in Magento Open Source that may also affect Adobe Commerce. The attack injects malicious PHP through Magento template style properties, poisoning a log or report file before triggering its execution through the Payment Transaction Failed Reminder email-rendering path. Sansec reproduced the chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 systems, while a confirmed victim ran fully patched 2.4.6-p15.

Following execution, attackers install a persistent Linux implant using cron and masquerade processes as kworker. Reported indicators include download host 247.cdnflare.xyz, WebSocket-over-TLS C2 endpoint 99.84.67.186:443, and artifacts under ~/.local/share/.gvfsd/ and /tmp/.kw_*. No vendor CVE, patch, or formal workaround was available at the time of reporting; organizations should investigate Magento hosts for compromise, apply layered web controls, consider disabling GraphQL where feasible, and rotate session and application credentials on potentially affected deployments.