Hackers are actively exploiting an unpatched vulnerability in Magento Open Source and Adobe Commerce to compromise online stores and install malware on Linux servers. The zero-day, dubbed “StyleSmuggler” by security firm Sansec, gives unauthenticated attackers remote code execution on vulnerable Magento systems, and Sansec says attacks began on September 4.
While the vulnerability itself is in Magento and Adobe Commerce rather than Linux, the malware being deployed after successful attacks is clearly built with Linux servers in mind. Sansec has observed Linux payloads for both x86-64 and ARM64 systems, including builds designed to blend into normal server environments.
Early versions reportedly disguised themselves as kworker, while newer variants have used fc-cache and chronyd. Those names could easily be overlooked because fc-cache is associated with font configuration on Linux, while chronyd is the legitimate Chrony time synchronization daemon used on many systems.
Sansec says a September 6 build identified itself as version 2.1.4 and used the fc-cache name. By September 7, the researchers had observed version 2.1.5 installing itself under a path resembling /tmp/.chrony-<ID>/chronyd, with some systems also receiving cron entries designed to restart the malware automatically.
The implant also uses Linux-specific mechanisms to avoid analysis. Sansec says it checks TracerPid in /proc/self/status to determine whether it is being traced and can refuse to communicate with its command-and-control infrastructure when tracing is detected.
Once StyleSmuggler exploitation succeeds, a small Rust-based backdoor launches in the background and connects to attacker infrastructure while waiting for commands. Sansec says it has not yet seen evidence that the backdoor itself has been weaponized beyond establishing access, although that could change as attackers continue modifying the malware.
One version also disguises its command-and-control traffic as ordinary network time synchronization. Every 60 seconds, the malware reportedly sends UDP packets over port 123, the same port normally associated with NTP, with packets constructed to resemble NTP server replies.
Sansec says much of the data inside those packets actually contains information about the compromised server. That can include the hostname, username, operating system version, available memory, disk usage, uptime, whether the process is running as root, and the implant version.
The technique could help malicious traffic blend into environments where outbound NTP traffic would not normally attract much attention. For administrators monitoring busy Linux systems, that makes the malware harder to spot through basic network checks alone.
The original intrusion begins higher up the software stack. StyleSmuggler abuses Magento’s template system by injecting malicious PHP code through styles properties, with the attack taking place in two stages.
An attacker first poisons data with PHP code and then causes Magento to execute that code while generating a failed payment email. No interaction with that email is required, so the attack does not depend on a store employee opening a message or clicking a link.
Sansec reproduced the complete unauthenticated attack chain against clean installations of Magento Open Source 2.4.7, 2.4.8, and 2.4.9. The first known victim reportedly ran Magento 2.4.6-p15 with the July and August 2026 security patches already installed, suggesting that simply staying current on Magento updates may not have been enough to prevent compromise.
The firm also says moving Magento session storage to Redis or a database does not necessarily stop the attack. In one case, an attacker reportedly switched techniques within seconds after an initial method failed and eventually succeeded through another path.
There may also be more than one group exploiting the vulnerability. Sansec says it observed a second, apparently unrelated attacker targeting affected systems and installing a PHP web shell, suggesting exposed Magento servers could attract multiple attackers independently.
Adobe Enterprise Support confirmed to Sansec on September 7 that the company was working on a patch, but there was no estimated release time. Adobe’s next scheduled security bulletin is September 8, although Sansec says it does not yet know whether that release will address StyleSmuggler.
Until a fix is available, Sansec recommends store operators investigate their servers for signs of compromise. Administrators should pay particular attention to suspicious processes masquerading as kworker, fc-cache, or chronyd, along with unexpected cron entries and files in temporary or hidden directories.
For Linux administrators, this is a reminder that the operating system does not need to contain the original vulnerability for a Linux machine to become the victim. In this case, attackers are breaking in through vulnerable e-commerce software and then deploying malware designed specifically to survive and hide on the Linux server underneath it.
With active exploitation underway and attackers already changing their tooling, Magento and Adobe Commerce administrators should treat StyleSmuggler as an urgent Linux server security problem until Adobe releases a fix.
Support independent tech journalism
NERDS.xyz is independently owned and operated. If you enjoy my coverage of Linux, AI, hardware, cybersecurity, and tech culture, consider supporting the site on Ko-fi.
Support NERDS.xyz