Dutch e-commerce security firm Sansec disclosed on 5 September that attackers have been actively exploiting an unauthenticated remote code execution flaw it has named "StyleSmuggler" to plant persistent backdoors in Magento and Adobe Commerce stores, with live attacks dating back to 4 September. The flaw affects every current version, including the newest Magento Open Source 2.4.9 release, and Sansec reproduced the full attack chain against clean, fully patched installations — the first confirmed victim was running 2.4.6 with July and August security updates already applied. No authentication is required to trigger it.
The attack is unusually quiet: Sansec found that StyleSmuggler abuses Magento's own "Payment Transaction Failed Reminder" email feature, and the malicious code runs the moment Magento internally renders that message — nobody has to open, or even receive, the email for the exploit to fire. From there, a dropper cycles through PHP functions until it finds one able to launch a process, then downloads a persistent implant. Hosting providers and Magento developers, including Disrex Group and ProxiBlue, have independently confirmed multiple compromised stores since the disclosure. As of 6 September, Adobe has not published a CVE, an advisory, or a patch; its Commerce security bulletin index still shows the 11 August update as the latest entry.
What this means for your business
If you or your developer run a store on Magento Open Source or Adobe Commerce, treat this as active and unpatched, not theoretical. Until Adobe ships a fix, security researchers are recommending several stopgaps: disable GraphQL on the storefront if you don't rely on it, disable PHP's proc_open function, and mount your /tmp directory as non-executable so a dropped file can't run. Check var/report/ and var/log/system.log for signs of exploitation, and treat any unexpected "Payment Transaction Failed Reminder" activity as a red flag worth investigating rather than a routine notification. If you're unsure whether your hosting setup already applies these mitigations, this is a good week to ask whoever manages your store to confirm it in writing — and to have a rollback and credential-rotation plan ready in case a check turns up something. Zero-days without a vendor patch are exactly when a quick outside review earns its keep.