A zero-day vulnerability, tracked as **StyleSmuggler**, is actively being exploited in attacks targeting **Magento** and **Adobe Commerce** installations. The first reported incident of exploitation was recorded on September 4, affecting a system running the latest security updates. E-commerce security firm **Sansec** confirmed that **Adobe Enterprise Support** is aware of the issue and is working on a fix, though no specific timeline for its release has been provided. **Magento**, a popular open-source e-commerce platform developed by **Adobe**, powers over 160,000 websites globally, including 14,000 within the top one million sites. ### Linux Backdoor Deployment The exploit observed by **Sansec** leverages **Magento**'s template system through PHP code injection. This technique generates a fraudulent "failed-payment" email, which then triggers arbitrary code execution on the server. Successful exploitation leads to the installation of a small, Rust-based backdoor. This malware operates as a background process, initially disguised as `[kworker/u:8:0]`. Newer variants camouflage themselves as `fc-cache` and are copied to `~/.cache/fontconfig/fc-cache`. **Sansec** researchers also noted that attackers establish persistence by adding a cron job, configured to execute every 30 minutes. While **Sansec** did not observe immediate follow-on activity, the backdoor possesses the capability to communicate with remote infrastructure and receive commands from its operators. Earlier samples of the backdoor utilized TLS/WebSockets for command-and-control (C2) communication. However, newer versions have evolved to disguise their traffic as Network Time Protocol (NTP). They achieve this by sending UDP packets to port 123 and using hostnames that mimic legitimate time-syncing infrastructure, effectively masking malicious traffic and potentially bypassing firewall rules. The malware also employs methods to determine the server's public IP address using services like `ipify`, `icanhazip`, `ident.me`, and `ipinfo.io`. Furthermore, it checks Linux's `TracerPid` value to detect tracing. If tracing is active, the malware will still install but will refrain from beaconing out to its C2. ### Detection and Mitigation **Sansec** advises that an unexpected surge of **Magento** "Payment Transaction Failed Reminder" emails could be an indicator of exploitation. They also recommend monitoring for `kworker` or `fc-cache` processes, suspicious cron entries, and unusual temporary files. In cases of suspected compromise, rotating **Magento** credentials is a critical immediate step. As of the time of writing, **Adobe** has not released official fixes for **StyleSmuggler**. However, the company's next scheduled security release is anticipated tomorrow, September 8. Until official patches become available, **Sansec** strongly recommends that website administrators disable **GraphQL** as a temporary mitigation measure. **BleepingComputer** has reached out to **Adobe** for confirmation on whether a fix for **StyleSmuggler** is planned for tomorrow's rollout but has not yet received a response.