StyleSmuggler is a zero-day vulnerability impacting all versions of Magento and Adobe Commerce, exploited through PHP code injection in the template system to execute arbitrary code. Exploitation results in the installation of a Rust-based Linux backdoor process disguised as 'kworker/u:8:0' or 'fc-cache' running from ~/.cache/fontconfig/fc-cache. The malware establishes persistence via a cron job running every 30 minutes and communicates with its command-and-control infrastructure using TLS/WebSockets or disguised NTP traffic over UDP port 123. It also performs anti-tracing checks and gathers the server's public IP. The first known exploitation was observed on September 4, 2026, even on fully patched systems. Adobe is developing a fix but has not provided a release timeline. Until then, disabling GraphQL is recommended to mitigate exploitation.

Successful exploitation allows attackers to execute arbitrary PHP code on Magento servers, leading to the installation of a stealthy Linux backdoor. This backdoor enables persistent remote access and command execution, potentially compromising the confidentiality, integrity, and availability of affected systems. The malware's use of disguised network traffic and anti-tracing techniques complicates detection and response. The vulnerability affects all Magento and Adobe Commerce versions, including those with the latest security updates at the time of initial exploitation.

Adobe is working on an official fix, but no patch is currently available. Until a fix is released, administrators should disable the GraphQL interface in Magento to reduce the attack surface. Monitoring for unusual 'Payment Transaction Failed Reminder' emails, suspicious 'kworker' or 'fc-cache' processes, unexpected cron jobs, and temporary files is recommended. If compromise is suspected, Magento credentials should be rotated. Follow Adobe's advisory for updates on patch availability.