A critical zero-day called StyleSmuggler is being actively exploited against Magento Open Source stores, giving unauthenticated attackers remote code execution. Dutch security firm Sansec, which disclosed the flaw on September 5, 2026, says every current version of Magento and Adobe Commerce is affected. It published early because stores were already being compromised.
Sansec reproduced the attack chain on clean 2.4.7, 2.4.8, and 2.4.9 installations, and the first identified victim ran 2.4.6-p15 with July and August 2026 patches applied. The exploit abuses Magento's own template and email systems, dropping a Rust implant disguised as a Linux kernel thread.
Adobe has issued no advisory, CVE, or fix. Its next scheduled security release is September 8, though Sansec says there is no confirmation it covers this bug. Until then, store owners are on stopgaps.
Disrex, ProxiBlue, and Graycore have each published unofficial patches guarding specific Magento classes. Disrex says its own patch is verified against 2.4.6 through 2.4.9. Sansec recommends temporarily disabling GraphQL, which classic and Hyvä themes generally don't need, unlike headless and progressive web app storefronts.
The layer that doesn't depend on knowing the exploit is server-level. Disable PHP's exec functions, proc_open included, since a list blocking five of the six stops nothing, and mount temporary directories with noexec. Check both var/report and var/log/system.log too, since Sansec's published check looks only at the first
Source: Cybersecurity News
