Stylesmuggler magento 0day

On 4 September 2026 at 22:20 UTC, an unauthenticated request began landing on Magento and Adobe Commerce storefronts and walking straight to remote code execution. No login. No admin session. No plugin. The flaw, tracked as CVE-2026-75650 and named StyleSmuggler, carries a CVSS of 10.0, and it was exploited in the wild for roughly three days before Adobe shipped an emergency hotfix. This is a short advisory: what the vulnerability is, how the intrusion behaves once it lands, what to look for, and what to do first.

▸ 1.1  What is affected

StyleSmuggler is an unauthenticated remote code execution flaw in the Magento and Adobe Commerce template pipeline, classified as improper neutralisation of special elements in a template engine (CWE-1336). It reaches every supported branch: Magento Open Source 2.4.4 through 2.4.9, Adobe Commerce and Adobe Commerce on Cloud through 2.4.9-2026-aug, and Adobe Commerce B2B through 1.5.3-2026-aug. Adobe released the fix out of band as APSB26-146, delivered as the VULN-39341 Composer hotfix rather than a minor version bump. It was added to the CISA Known Exploited Vulnerabilities catalogue on 8 September 2026.

▸ 1.2  How the name earns itself

The attack is two moves, and neither one looks like an exploit on its own. In the first move the threat actor abuses the template system’s handling of styles properties, reported to be reachable through an unauthenticated GraphQL request, to smuggle PHP source past the platform’s template safeguards and into a file Magento writes itself during normal operation: a payment failure report under var/report/, or an entry in var/log/system.log. Nothing executes yet. The code is just sitting in a log.

The second move triggers Magento’s built-in Payment Transaction Failed Reminder email. Rendering that template pulls the poisoned file through code paths that exist to serve the command-line dependency-injection compiler, and the smuggled PHP runs on the server. Execution happens during template rendering, so the email never has to be delivered for the code to fire. The elegance, from the attacker’s side, is that the dangerous step is the shop performing its own routine housekeeping on a file the shop itself created.

Code execution is the door. The payload behind it is a compiled implant: a stripped, statically linked binary of roughly 1.9 to 2.2 MB, built for both x86-64 and ARM64, so it runs on the full spread of hosting hardware without a dependency to satisfy. The sample listed in the indicators below is the chronyd variant our Threat Intelligence team pulled from internal investigations.

▸ 2.1  Persistence through the cron spool

Persistence is a cron job, but not an ordinary one. The implant writes directly to the cron spool file rather than going through the normal crontab replacement path, which sidesteps the logging that a crontab edit would otherwise leave behind. The entry re-launches the binary on a short interval, observed between five and thirty minutes across variants, so a killed process is back within the hour. An operator who checks only for recent crontab modifications, and not the spool contents, will not see it.

▸ 2.2  Hiding in plain sight

The implant does not hide from process listings, it blends into them. Early samples presented as [kworker/u:8:0], borrowing the bracketed naming of a Linux kernel worker thread that an administrator scrolls past by reflex. Later ones copy themselves to ~/.cache/fontconfig/fc-cache, a path that reads exactly like the font cache, or run as gvfsd-user and chronyd, the names of real desktop and time-synchronisation daemons. The evasion is entirely at the level of naming and location: on a busy server, a familiar name in a familiar place is the cheapest camouflage there is.

▸ 2.3  Command and control shaped like normal traffic

The command-and-control channel followed the same instinct and then went quieter. Early variants spoke TLS over WebSocket to port 443, indistinguishable at a glance from ordinary HTTPS. Newer ones drop the connection into UDP on port 123 shaped to look like NTP, reaching out to hostnames built to pass a tired eye: ntp.timesync.net, time.microsft.run, pool.microsft.studio. Before calling home the implant learns its own public address through legitimate lookup services (ipify, icanhazip, ident.me, ipinfo.io), a step that itself generates only benign-looking requests. In at least one analysed case no outbound C2 was seen at all while the implant was resident, a reminder that absence of C2 traffic is not absence of compromise.

What the operator gets from all of this is the store, from the inside: administrative access, the Magento encryption key, REST, SOAP, GraphQL and OAuth tokens, payment-gateway API credentials, and the integrity of the checkout page itself. On an e-commerce host, that last item is the one that turns a server compromise into a skimming operation against every customer who pays.

A vulnerability is a door. What decides the outcome is the threat actor walking through it, and how they work once inside. Our Threat Intelligence team tracks StyleSmuggler within a scope of 287 adversary groups and offensive tools, and has integrated the indicators below into the Fortgale Intelligence Feed for preventive blocking across our client base.

▸ 3.1  MITRE ATT&CK mapping

Tactic	Technique	ID
Initial Access	Exploit Public-Facing Application	T1190
Execution	Server-side template injection via styles property	T1190
Persistence	Server Software Component: Web Shell (poisoned PHP in var/report / var/log)	T1505.003
Execution	Command and Scripting Interpreter: Unix Shell	T1059.004
Persistence	Scheduled Task/Job: Cron (direct spool write)	T1053.003
Defense Evasion	Masquerading: Match Legitimate Name or Location (kworker, fc-cache, gvfsd-user, chronyd)	T1036.005
Defense Evasion	Obfuscated Files or Information (stripped, statically linked binary)	T1027
Defense Evasion	Impair Defenses: Indicator Blocking (bypass of crontab logging)	T1562.006
Discovery	System Network Configuration Discovery: Internet Connection Discovery	T1016.001
Command and Control	Encrypted Channel (TLS/WebSocket over 443)	T1573
Command and Control	Non-Application Layer Protocol (UDP shaped as NTP on 123)	T1095
Command and Control	Data Obfuscation: Protocol Impersonation	T1001.003

The mapping is our analytical reconstruction from public reporting and sample analysis, at medium-high confidence; the two Execution rows share T1190 because the injection and its rendered execution are one exploitation flow rather than two separate techniques.

▸ 3.2  Indicators of Compromise

Indicator (defanged)	Type	Role
1a3374ffac5b0a62467612f264c49792d206304d4514409c982325c91231375d	SHA-256	Implant, chronyd variant (ELF x86-64, static-pie, 2.18 MB)
15d35ff26fe5640be1ad12f3065472b95d79f4b2	SHA-1	Same sample
63290e1c707a7ff9e1c7c56428d3f656	MD5	Same sample
4352cabaa451e5a894535fbcc4d46628701303322a13745cb5479d7d0534ae8e	SHA-256	Implant, kworker variant (x64)
d2fbf9eb75c495bfea48790d3b228fab0c15a282419c3d3f5e49294c4e1a3e82	SHA-256	Implant, kworker variant (ARM)
247.cdnflare[.]xyz · 209.141.43[.]95	Host / IP	Payload delivery
www.incofar[.]it/js/jquery/plugins/ajaxfileupload/mag.txt	URL	Second-stage download (compromised third party)
99.84.67[.]186:443 · windwsecurity[.]run:443	C2	TLS/WebSocket channel
ntp.timesync[.]net · time.microsft[.]run · pool.microsft[.]studio · ntp.synctime[.]to · ntpsync[.]io · 185.157.160[.]251	C2	NTP-shaped UDP/123 channel
~/.cache/fontconfig/fc-cache	Path	Implant copy location (fc-cache variant)
var/report/ · var/log/system.log	Path	Files poisoned with PHP in stage one

Indicators are integrated into the Fortgale Intelligence Feed and will be updated as the StyleSmuggler infrastructure evolves. For the full indicator set, or to confirm exposure of a specific store, contact us at info@fortgale.com.

Immediate. Apply the VULN-39341 hotfix (APSB26-146) on every Magento and Adobe Commerce instance in the affected range. Understand that the patch closes the door but does not clean a store that was already entered: exploitation ran for days before the fix existed, so treat any unpatched store that was internet-facing between 4 and 8 September 2026 as potentially compromised until proven otherwise. As interim hardening, disable GraphQL until the hotfix is fully deployed, add proc_open to PHP’s disable_functions, and mount /tmp, /var/tmp and /dev/shm with noexec.

Short term. Hunt, do not just scan. Inspect the cron spool directly, not the crontab edit history, for entries launching binaries from user cache or temporary paths. Look for processes whose name matches a legitimate daemon (kworker, fc-cache, gvfsd-user, chronyd) but whose binary sits in an unexpected location. Grep var/report/ and var/log/system.log for PHP tags. Review outbound UDP/123 to hosts that are not your configured NTP servers.

Structural. If compromise is confirmed, patching is the beginning, not the end. Rotate the Magento encryption key, flush session storage and Redis, and reset every secret the store held: admin passwords, REST, SOAP, GraphQL and OAuth tokens, payment-gateway API credentials, database credentials, and SSH and deploy keys. Then verify checkout-page integrity, because on an e-commerce host the credential the attacker most wants is the customer’s card, and the place they take it is the payment form.

A cyber attack is not something. It is someone. StyleSmuggler is a clean illustration: the vulnerability is a door, but what walks through is an operator who reuses tooling, dresses their process up as a system daemon, and shapes their traffic to look like the clock ticking. You do not defend against a CVE. You defend against the person using it.

Knowing the adversary is the first act of defence. Stopping them in time is the second.

Talk to our analysts about StyleSmuggler exposure across your Magento estate, or request a threat briefing on StyleSmuggler and its indicators.