Loading story…
Attackers are actively exploiting StyleSmuggler, an unpatched unauthenticated remote-code-execution chain in Magento Open Source that may also affect Adobe Commerce. The attack injects malicious PHP through Magento template style properties, poisoning a log or report file before triggering its execution through the Payment Transaction Failed Reminder email-rendering path. Sansec reproduced the chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 systems, while a confirmed victim ran fully patched 2.4.6-p15.
Following execution, attackers install a persistent Linux implant using cron and masquerade processes as kworker. Reported indicators include download host 247.cdnflare.xyz, WebSocket-over-TLS C2 endpoint 99.84.67.186:443, and artifacts under ~/.local/share/.gvfsd/ and /tmp/.kw_*. No vendor CVE, patch, or formal workaround was available at the time of reporting; organizations should investigate Magento hosts for compromise, apply layered web controls, consider disabling GraphQL where feasible, and rotate session and application credentials on potentially affected deployments.
See which actors are running it and whether you're in range.
9 events from the most recent confirmed update back to the earliest known activity.
Sansec observed a second Rust-based StyleSmuggler backdoor variant masquerading as fc-cache. The implant disguised command-and-control traffic as NTP replies and collected host and public-IP information before beaconing.
Sansec publicly reported that the actively exploited unauthenticated StyleSmuggler RCE affects Magento Open Source and Adobe Commerce, including current Magento releases through 2.4.9. Adobe had not issued a CVE, advisory, official patch, or workaround as of September 6.
Disrex Group responded to two compromised Magento stores and identified a third that had been attacked but not breached. Its investigation documented poisoned system.log files, evolving attacker headers, direct cron-file persistence, and additional malware hashes and attack-source indicators.
By 23:10, Sansec detected the StyleSmuggler implant on unrelated stores, indicating the activity was not limited to the first confirmed victim. The implant used cron persistence and masqueraded as a kworker process.
Sansec found the active campaign and reproduced the complete unauthenticated attack chain on clean Magento Open Source 2.4.7, 2.4.8, and 2.4.9 installations within hours. The research established that current Magento Open Source releases were exploitable despite existing safeguards.
Sansec recorded the first confirmed StyleSmuggler exploitation at 22:20 against a Magento 2.4.6-p15 store that had July and August 2026 security patches applied. The unauthenticated chain poisoned Magento-managed files and led to remote code execution and backdoor deployment.
Disrex documented that StyleSmuggler can drive Magento DI compiler scanner classes to include attacker-selected poisoned log or report files, executing injected PHP. It released and verified a source-level guard for Magento 2.4.6–2.4.9 that blocks those scanner sinks during HTTP requests while retaining CLI compilation functionality.
Sansec analyzed a 485-byte PHP dropper on affected stores that writes a header-protected web shell under the Magento product-image cache. It assessed this tooling as apparently unrelated to the StyleSmuggler implant and could not determine whether the separate actor gained access through StyleSmuggler or another route.
Disrex Group, ProxiBlue, and Graycore published unofficial hardening patches targeting affected Magento classes and email-template functions. Disrex cautioned that its rules block the observed attack pattern rather than remediate the underlying vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 22 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
9 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourcecysecurity.news
Open sourcecysecurity.news
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcethehackernews.com
Open sourcesansec.io
Open sourcegithub.com
Open sourcesansec.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors conducted a mass exploitation campaign against **Magento** e-commerce deployments by abusing **CVE-2025-54236** (aka **SessionReaper**), an authentication/session management flaw that allows attackers to bypass login controls by **reusing improperly invalidated session tokens**. Reporting based on an **Oasis Security** investigation described large-scale scanning that identified **1,000+ exposed/vulnerable Magento Commerce APIs** and confirmed compromises of **200+ websites** (with one count citing **216 victim sites**), indicating broad weaponization by multiple actors across regions. After hijacking valid admin sessions via replayed “zombie” tokens, intruders escalated privileges to achieve **root-level control** of affected Linux servers, enabling follow-on actions such as deploying **web shells** for persistent remote command execution and full administrative takeover of storefront infrastructure. Separately, research on **eSkimming/Magecart** activity highlighted that browser-based JavaScript payment-card theft remains persistent across e-commerce sites—often via third-party script/supply-chain compromise—and a longitudinal study of **550** previously compromised sites found **18%** still infected a year later, underscoring that e-commerce compromises frequently involve durable footholds and re-compromise even after initial cleanup.
Jun 29, 2026
A critical vulnerability in the Magento ecommerce platform, identified as CVE-2025-54236 and dubbed 'SessionReaper,' has been actively exploited in the wild. The flaw allows attackers to hijack user sessions and achieve unauthenticated remote code execution (RCE) on affected Magento installations. Security researchers observed a surge in exploitation attempts following the public release of a proof-of-concept (PoC) exploit, with attackers deploying web shells and conducting reconnaissance using classic PHP probes. Adobe released an emergency patch for the vulnerability, and organizations are urged to apply it immediately to mitigate risk. Magento's widespread use and history of critical vulnerabilities make this flaw particularly attractive to threat actors. Exploitation attempts have targeted over 130 hosts from multiple IP addresses within 48 hours of the PoC's publication. Web application firewalls, such as Akamai's Adaptive Security Engine, have been effective in mitigating some exploit attempts by default. The vulnerability's critical nature and active exploitation highlight the urgent need for patching and enhanced monitoring of Magento deployments.
Jun 29, 2026
Adobe disclosed **CVE-2024-34102**, a critical (CVSS 9.8) pre-authentication XML external entity (XXE) flaw in Adobe Commerce and Magento. The vulnerability lies in recursive REST API deserialization and can be reached through an unauthenticated guest-cart shipping-estimation endpoint, allowing attacker-controlled data to instantiate `SimpleXMLElement` objects and retrieve local or remote resources. An attacker could use the flaw to read Magento's `app/etc/env.php`, exposing the installation's cryptographic key and potentially enabling forged administrator JWTs for privileged Magento API access. Research further indicates the issue could be chained with PHP filter techniques and **CVE-2024-2961** toward remote code execution; organizations should apply Adobe's security update, as early third-party emergency mitigations were bypassable and later revised.
Sep 3, 2026