Magento Zero-Day 'StyleSmuggler' Lets Attackers Backdoor Online Stores

Key points

• Dutch e-commerce security firm Sansec disclosed an unpatched flaw in Magento Open Source and Adobe Commerce on September 5.
• Attacks in the wild started on September 4, according to Sansec's advisory.
• The bug, nicknamed StyleSmuggler, lets attackers run their own code on a shop's server without needing a login.
• Adobe has not yet released a patch at the time of publication.
• Shops running Magento or Adobe Commerce are being told to check logs and lock down admin access now.

Criminals are attacking online shops built on Magento Open Source and Adobe Commerce using a brand new flaw that the software's maker has not yet fixed. Dutch e-commerce security firm Sansec, which found the bug, is calling it StyleSmuggler and says the first attacks landed on September 4.

The short version, if you run a store on this software: assume you are a target this week.

What is actually broken?

The flaw is what security people call an unauthenticated remote code execution bug, meaning an attacker on the open internet can make the shop's server run commands for them without ever logging in. That is close to the worst grade of web vulnerability there is. In practice it hands the intruder the keys to the checkout process, the customer database, and the payment flow.

Sansec has not published full technical detail, and that is deliberate. The firm says it went early with an advisory because attacks were already happening and site owners needed a heads-up before Adobe ships a patch.

Who is affected?

Both the free Magento Open Source project and the paid Adobe Commerce product are in scope. Together they power a large slice of independent online retail, from small boutiques to household-name brands. If your shop URL runs on Magento, the same code is under the hood as the enterprise version.

Adobe inherited Magento in 2018 and now ships it as Adobe Commerce. Fixes for both usually arrive together on Adobe's security bulletin schedule.

What are attackers doing with it?

Sansec's advisory, first reported by The Hacker News, points to attackers using StyleSmuggler to plant backdoors on stores. That is the standard playbook here. Once a Magento server is popped, the criminals typically drop a small piece of hidden code, often called a web skimmer, which quietly copies shoppers' card numbers as they type them at checkout and sends them to a server the criminals control. Shoppers see nothing wrong.

This family of attacks is known as Magecart, and it has been running against Magento shops for years. The failure mode here is depressingly familiar: a critical Magento bug drops, exploitation starts within days, and a long tail of small shops never patches.

What should shop owners do right now?

If you run the software, treat this as an active incident, not a heads-up. There is no patch yet, so the useful moves are containment.

Restrict access to the admin panel by IP address if you can. Put the site behind a web application firewall with virtual patching rules for Magento. Check server logs and the filesystem for files you did not create, especially anything modified since September 3. Watch Adobe's security bulletins page for the emergency fix.

What about shoppers?

Ordinary customers cannot tell from the outside whether a store has been backdoored. The sensible habit, and it applies well beyond this bug, is to pay with a credit card or a payment service like PayPal or Apple Pay rather than a debit card. Credit and wallet payments give you a chargeback route if a skimmer scoops your details.

Operational takeaway: if you run Magento, your weekend job is log review and admin lockdown, not waiting for the CVE.