Magento stores breached by zero day with no authentication required

Attackers have quietly slipped through the defenses of Magento Open Source and Adobe Commerce, planting persistent backdoors on online stores by exploiting a zero-day flaw that requires no authentication and no user interaction. The breach is not theoretical-multiple stores have already been compromised, and the vulnerability remains unpatched as of September 6, with Adobe yet to acknowledge the threat or offer any fix.

The first signs of trouble emerged when Dutch security firm Sansec detected active exploitation on September 4, prompting an immediate advisory. The flaw, dubbed StyleSmuggler, allows attackers to execute arbitrary code on the server, install a stealthy binary, and maintain access through a cron job that revives the implant every five minutes. The attack chain is so effective that even stores running the latest security updates, including those with July and August patches, have fallen victim.

Come funziona l'attacco e chi è stato colpito

Sansec's analysis reveals a two-stage attack: first, malicious PHP code is injected into a file Magento itself writes-often a log or failure report. Then, the attacker triggers Magento's "Payment Transaction Failed Reminder" email, causing the platform to execute the poisoned file. The exploit works even if the email never reaches an inbox, and no authentication is needed at any step.

Disrex Group, a Magento hosting and development provider, independently confirmed the breach on two of its hosted stores. Both ran Magento Open Source-one on version 2.4.8 with Sansec Shield enabled, the other on 2.4.7-p2 without Shield. Both were breached within an eight-hour window before any defense existed. Disrex's forensic work uncovered a stripped, statically linked Rust binary masquerading as a Linux kernel thread, hidden in the site user's home directory and kept alive by a cron entry written directly to the spool file. On one store, the implant re-added its cron job within a second of removal, and in another, it made no outbound connections, instead reading session data from the store's own Redis instance.

Despite the sophistication, Disrex found no evidence of data exfiltration, rogue admin accounts, or payment skimmers. Both stores were contained within hours, all sessions invalidated, and credentials rotated as a precaution. The company's rapid response-sweeping its entire estate and publishing a detailed incident write-up-stands in stark contrast to Adobe's silence.

Indicatori di compromissione e segnali di allarme

Sansec and Disrex have published a comprehensive list of indicators: a process named [kworker/u:8:0] running as a non-root user, binaries hidden under ~/.local/share/.gvfsd/gvfsd-user, and cron jobs that restart the implant every five minutes. SHA-256 hashes of known samples and attacker infrastructure details-including the domain 247.cdnflare[.]xyz and several IP addresses-are available for defenders. Notably, a burst of "Payment Transaction Failed Reminder" emails with unresolved template variables and .invalid domains surfaced one compromise, making such emails a critical early-warning sign for merchants.

Sansec's eComscan tool can detect the implant, but only if the scan path includes the account's home directory-one store was missed because the scan targeted only the document root. Disrex and other community members have published temporary mitigations, including disabling GraphQL (which breaks headless and PWA storefronts), web server rules to block exploit parameters in query strings, and direct patches to Magento's dependency-injection code. However, these are stopgaps, not true fixes, and attackers can bypass some mitigations by sending payloads in POST or JSON bodies.

Adobe tace mentre la comunità si mobilita

Adobe has yet to issue an advisory, assign a CVE, or release a patch. Its last security bulletin dates to August 11, leaving merchants exposed and forcing the community to improvise. Disrex, ProxiBlue, and Graycore have all published unofficial patches or modules, with Disrex and ProxiBlue independently arriving at identical guards for the vulnerable code paths. Graycore's module hardens several points in the chain but warns that it is not a complete fix and that stores may already be compromised.

For now, the only vendor guidance comes from Sansec, which recommends disabling GraphQL and rotating credentials wherever the implant is found. Disrex's cleanup guide emphasizes preserving evidence, removing the cron job before killing the process, and avoiding actions like composer install that could destroy forensic timestamps. Hosting providers Nexcess and Liquid Web have issued incident notices and are reviewing their environments, but neither has confirmed customer impact.

The scale of the attack is still unclear. Disrex recorded 26 unique attacker source addresses across its two stores, with most traffic coming from residential proxies and only a minority from the IPs listed by Sansec. Blocking a single address would have stopped less than a quarter of the observed attack traffic. No group has claimed responsibility, and the full exploit chain remains unpublished, with both Sansec and Disrex promising further technical details in future updates.

Impatto e rischi per l'e-commerce italiano

With all current Magento Open Source versions confirmed vulnerable-including 2.4.7, 2.4.8, and 2.4.9-and Adobe Commerce likely affected, the risk to Italian and European e-commerce is immediate and severe. Merchants relying on official patches are defenseless, and even advanced security products like Sansec Shield only blocked attacks after new rules were deployed. The attack's stealth, speed, and ability to bypass authentication make it a potent threat, echoing the scale of previous mass exploits such as those reported earlier against WordPress plugins.

Adobe's silence is indefensible. When a zero-day is being exploited in the wild, with merchants losing control of their stores and the community forced to improvise mitigations, the absence of official communication or a patch is a dereliction of duty. The e-commerce ecosystem cannot afford to wait for scheduled releases while attackers move faster than the vendor. Until Adobe acts, every Magento merchant is gambling with their business-and the odds are not in their favor.