Active Zero-Day Exploits Magento and Adobe Commerce Stores With No Patch Available

An unpatched vulnerability named StyleSmuggler is actively compromising Magento Open Source and Adobe Commerce storefronts without requiring login credentials. The exploit installs a persistent 1.9 MB Rust backdoor disguised as a Linux kernel thread under the site user's home directory. Attackers execute the payload by planting PHP code that triggers Magento's standard "Payment Transaction Failed Reminder" email process. Adobe has not released a CVE, official patch, or confirmed which specific versions are vulnerable as of September 6. Third-party responders at Disrex observed the backdoor making 28 connections to a compromised store's Redis instance to read session storage. "Sansec is publishing early because stores are being compromised right now." — Sansec.