Attackers are exploiting a zero-day vulnerability in Magento Open Source and Adobe Commerce, dubbed StyleSmuggler, which allows unauthenticated remote code execution (RCE). The flaw, discovered by Dutch security firm Sansec, is currently being exploited in the wild to install persistent backdoors on e-commerce servers. The attack chain involves planting malicious PHP code in system logs or report files and triggering execution through platform features like GraphQL or the "Payment Transaction Failed Reminder" email system.
Security researchers from Disrex Group have confirmed active compromises and provided technical analysis of the malware, which disguises itself as a Linux kernel thread. Because Adobe has yet to release an official patch or CVE, interim mitigations include disabling GraphQL, applying unofficial community patches, and hardening server environments by restricting proc_open and mounting temporary directories with noexec flags.
Top comments (0)