In early September 2026, security researchers at Sansec discovered a wave of attacks on Magento shops. Behind it was a previously unknown vulnerability, now known as StyleSmuggler and tracked as CVE-2026-75650. It carries the highest possible rating (CVSS 10.0): an attacker needs neither credentials nor a customer account to run their own code on the server.
What happened?
The first confirmed exploitation dates from 4 September 2026. Adobe published security bulletin APSB26-146 with a hotfix on 7 September – three days in which shops had no official protection.
The attack runs in two steps:
- Inject code: A crafted request to a payment endpoint deliberately fails. Magento writes the complete request – including the injected PHP code – to an error report under
var/report/. - Execute code: A second request to the GraphQL API makes Magento include exactly that file while rendering an email template. The code runs during rendering – whether the email is actually sent makes no difference.
Later variants use log and session files instead of error reports.
Who is affected?
Magento Open Source and Adobe Commerce versions 2.4.4 to 2.4.9 are affected. Adobe tested the hotfix on the current patch levels of these versions. Important: according to Sansec, one affected shop had applied all security updates from July and August. Being "up to date" was no protection.
For older versions (2.2, 2.3 and 2.4.0 to 2.4.3), Adobe provides no fix. Only third-party backports help here – or, better, an upgrade.
What the attackers install
After a successful attack, the attackers drop a backdoor that hides well:
- It runs under names that look like system processes, such as a kernel thread,
fc-cacheorchronyd. - It talks to its control server using packets that look like time synchronisation (NTP).
- Cron entries restart it after a reboot.
Sansec also observed a second group that drops web shells in the product image cache and, on one shop, additionally hid a card skimmer in the configuration.
A patch is not enough
The hotfix closes the hole – but it removes nothing an attacker has already placed on the server. Anyone who was vulnerable between early September and applying the fix should therefore check whether they were affected.
Our recommendations for shop operators:
- Apply the hotfix (Adobe patch
VULN-39341from APSB26-146) and check withvendor/bin/magento-patchesthat it is active. Apply the following security updates promptly too – such as APSB26-153 from October. - Look for traces: error reports in
var/report/containing PHP code, PHP files inpub/media, unknown cron entries, processes with system names running from unusual directories, new admin users,<script>entries in configuration and CMS blocks. - If in doubt, rotate credentials: admin passwords, API tokens, payment and database access, SSH and deploy keys and the Magento encryption key – at the source, not just in the shop.
- Put a web application firewall in front that filters such attacks early.
How we monitor our servers
For the shops running with us, we have built detection into our control centre Pharos. A check program searches every server hourly for the known traces of such attacks:
- missing StyleSmuggler fix and error reports containing PHP code,
- processes disguised as kernel threads and programs in temporary directories,
- connections to known attacker addresses,
- skimmer and backdoor code in the shop, PHP in media directories,
- new admin users, integrations and scripts in configuration and CMS,
- changes to crontabs, system services, SSH keys and user accounts.
If anything deviates from the verified state, Pharos reports it immediately. Deployments and package updates don't trigger false alarms: if a changed file matches the state in version control or the checksum of its package, it is accepted silently. And if a check stops reporting, Pharos raises an alarm as well.
Conclusion
StyleSmuggler shows how quickly an unknown flaw turns into a mass attack – and that "fully patched" alone doesn't mean secure. What matters is applying updates quickly and detecting when someone has got in anyway.
Not sure whether your shop is affected? We're happy to check your Magento shop and help secure it.