Sansec researchers have disclosed a new, actively exploited vulnerability in Magento Open Source and Adobe Commerce dubbed StyleSmuggler. The flaw allows unauthenticated remote attackers to execute arbitrary code on vulnerable storefronts — the worst-case scenario for any e-commerce platform. Worse, according to the reporting, attackers are using the flaw to install persistent unauthorized access mechanisms on stores that operators may believe are already patched against prior issues. This is not a theoretical exercise: exploitation is confirmed in the wild against live storefronts.
Magento and Adobe Commerce power a substantial share of the global e-commerce market. A successful compromise of a storefront means full access to customer PII, stored order data, and — critically — the ability to inject payment skimmers (Magecart-style) directly into the checkout flow. If you operate, host, or defend a Magento/Adobe Commerce property, treat this as an active incident condition, not a patch Tuesday item.
Technical Analysis
Affected Products
- Magento Open Source — current supported branches (2.4.x line)
- Adobe Commerce (on-premises and cloud-hosted storefronts where merchants control application code) — current supported branches
Per Sansec's reporting, the vulnerability affects current versions — meaning no vendor patch existed at the time of disclosure, and the exploit path works against stores running the latest released code. This is a true unpatched/zero-day condition, and Adobe has not yet assigned a CVE identifier at the time of this writing. Do not wait for a CVE to begin hunting.
How the Attack Works (Defender's View)
While full technical root-cause details remain limited pending a vendor fix, the observable attack chain reported by Sansec follows a pattern consistent with prior Magento exploitation campaigns:
- Unauthenticated entry: The attacker sends crafted HTTP requests to the storefront — no admin credentials, no session, no prior access required. The vulnerable code path is reachable from the public internet, which is precisely what makes this urgent.
- Code execution on the web tier: Successful exploitation yields code execution in the context of the web server / PHP-FPM worker process (typically
www-data,nginx, or the configured Magento filesystem user). - Persistence via unauthorized access mechanism: The attacker writes a backdoor to disk — historically, in Magento incidents these land in web-accessible directories such as
pub/media/,pub/static/,var/, or are injected into existing legitimate PHP files (e.g.,index.php, theme files, orapp/code/modules) to survive casual inspection. - Post-exploitation: Typical follow-on activity includes deployment of payment skimmers into checkout templates, creation of rogue admin accounts in the
admin_usertable, and staging for data exfiltration.
The "already patched" caveat deserves emphasis: attackers are re-compromising stores where operators applied prior security updates. Two explanations exist — the new flaw bypasses previous fixes, or attackers planted dormant persistence during an earlier intrusion that survived patching. Either way, patching alone is not sufficient assurance; you must hunt for existing compromise.
Exploitation Status
- In-the-wild exploitation: CONFIRMED — Sansec observed active attacks against live storefronts.
- Vendor patch: NOT AVAILABLE at time of disclosure
- CVE assignment: Pending — no identifier has been published in the source reporting
- CISA KEV: Not yet listed — monitor https://www.cisa.gov/known-exploited-vulnerabilities-catalog for addition
Detection & Response
The detections below target the highest-fidelity behaviors of this attack class: PHP-FPM/web workers spawning shell processes, unexpected PHP file creation in web-accessible Magento directories, and anomalous inbound request patterns. These are the behaviors a mature SOC should already have baseline coverage for — tune them against your store's normal deployment activity (Magento deployments legitimately write PHP under generated/ and var/).
Sigma Rules
---
title: Magento PHP Worker Spawning Shell Process
tid: 3f8b2c41-9a1e-4d5c-b7a2-6e1f0c9d8b3a
status: experimental
description: Detects PHP-FPM or web server processes spawning command shells, a strong indicator of web application RCE such as the StyleSmuggler Magento/Adobe Commerce exploit.
references:
- https://securityaffairs.com/198603/uncategorized/stylesmuggler-the-magento-zero-day-behind-new-store-attacks.html
- https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.execution
- attack.t1059.004
- attack.initial_access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- '/php-fpm'
- '/php-fpm8.1'
- '/php-fpm8.2'
- '/php-fpm8.3'
- '/apache2'
- '/httpd'
- '/nginx'
selection_child:
Image|endswith:
- '/sh'
- '/bash'
- '/dash'
- '/zsh'
- '/curl'
- '/wget'
- '/perl'
- '/python'
- '/python3'
- '/nc'
- '/ncat'
condition: selection_parent and selection_child
falsepositives:
- Legitimate Magento cron jobs invoking CLI tools (review parent-child lineage)
- Deployment pipelines executing composer or magento CLI commands
level: high
---
title: PHP File Created in Magento Web-Accessible Directory
tid: 7c4d1e92-5b3a-4f8c-a6d9-2e7b0a1c4f5d
status: experimental
description: Detects creation of PHP files in Magento web-accessible directories (pub/media, pub/static, var) where backdoors are commonly planted following storefront compromise.
references:
- https://securityaffairs.com/198603/uncategorized/stylesmuggler-the-magento-zero-day-behind-new-store-attacks.html
- https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: linux
detection:
selection_path:
TargetFilename|contains:
- '/pub/media/'
- '/pub/static/'
- '/var/cache/'
- '/var/session/'
- '/var/log/'
- '/downloader/'
- '/upload/'
selection_ext:
TargetFilename|endswith:
- '.php'
- '.phtml'
- '.phar'
- '.php5'
- '.php7'
condition: selection_path and selection_ext
falsepositives:
- Static content deployment writing .phtml under pub/static (rare; correlate with deployment windows)
- Extension installation placing files under var/
level: high
---
title: Outbound Connection from PHP-FPM Worker to External Host
tid: 1a9e5f37-2c8d-4b6a-9e3f-4d0c7a5b2e61
status: experimental
description: Detects PHP-FPM workers initiating outbound network connections, consistent with post-exploitation tooling download or data exfiltration following Magento RCE.
references:
- https://securityaffairs.com/198603/uncategorized/stylesmuggler-the-magento-zero-day-behind-new-store-attacks.html
- https://attack.mitre.org/techniques/T1071/001/
author: Security Arsenal
date: 2026/04/06
tags:
- attack.command_and_control
- attack.t1071.001
- attack.exfiltration
logsource:
category: network_connection
product: linux
detection:
selection:
Image|endswith:
- '/php-fpm'
- '/php-fpm8.1'
- '/php-fpm8.2'
- '/php-fpm8.3'
- '/php'
Initiated: 'true'
filter_local:
DestinationIp|startswith:
- '10.'
- '172.16.'
- '172.17.'
- '172.18.'
- '172.19.'
- '172.2'
- '172.30.'
- '172.31.'
- '192.168.'
- '127.'
condition: selection and not filter_local
falsepositives:
- Payment gateway API calls (authorize.net, Stripe, PayPal endpoints) — allowlist known gateway IPs
- Shipping/tax service integrations
level: medium
KQL — Microsoft Sentinel / Defender
This query hunts for web server and PHP worker process anomalies on Linux hosts ingested via Syslog, plus process lineage via Defender for Endpoint if your storefront infrastructure is onboarded. Run it across all hosts tagged as Magento/Adobe Commerce web tiers.
// Hunt 1: PHP-FPM / web server spawning shell or download tooling (Syslog ingestion)
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName has_any ("php-fpm", "apache2", "httpd", "nginx")
or SyslogMessage has_any ("php-fpm", "apache2", "httpd")
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "/bin/dash", "curl ", "wget ", "/usr/bin/perl", "python", "nc -", "ncat ")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc
;
// Hunt 2: Defender for Endpoint process lineage on web tier hosts
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName has_any ("php-fpm", "php", "apache2", "httpd", "nginx")
| where FileName in~ ("sh", "bash", "dash", "curl", "wget", "perl", "python", "python3", "nc", "ncat", "base64")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| order by TimeGenerated desc
;
// Hunt 3: Inbound web requests with suspicious patterns against Magento paths (CEF/WAF logs)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL has_any ("/pub/media/", "/var/", "/downloader/", "/app/etc/")
| where RequestURL has_any (".php", ".phtml", ".phar") or RequestMethod == "POST"
| summarize Requests = count(), DistinctSources = dcount(SourceIP) by RequestURL, SourceIP, bin(TimeGenerated, 1h)
| where Requests > 20 or DistinctSources > 5
| order by Requests desc
Tune Hunt 3's thresholds against your traffic baseline — legitimate catalog media requests are GET-heavy but should never reference .php execution paths under pub/media.
Velociraptor VQL
Deploy this hunt across your Magento web tier to surface recently created or modified PHP files in directories where backdoors are staged, and to enumerate shells spawned by the web process during the suspected exposure window.
-- StyleSmuggler hunt: anomalous PHP artifacts in Magento web-accessible directories
LET magento_root = '/var/www/html'
LET php_artifacts = SELECT
FullPath,
Size,
Mtime,
Ctime,
Btime
FROM glob(
globs=[
magento_root + '/pub/media/**.php',
magento_root + '/pub/media/**.phtml',
magento_root + '/pub/static/**.php',
magento_root + '/var/**.php',
magento_root + '/var/log/**.php',
magento_root + '/var/session/**.php',
magento_root + '/downloader/**.php',
magento_root + '/pub/*.php'
]
)
WHERE Mtime > now() - 604800 -- last 7 days
SELECT * FROM php_artifacts ORDER BY Mtime DESC
;
-- Enumerate shell descendants of PHP-FPM / web server processes
SELECT
Pid,
Ppid,
Name,
Exe,
CommandLine,
Username,
CreateTime
FROM pslist()
WHERE Name =~ 'php-fpm|apache2|httpd|nginx'
OR CommandLine =~ '/bin/(sh|bash|dash)|curl |wget |base64'
ORDER BY CreateTime DESC
Any .php file under pub/media/ is suspicious almost by definition — that directory serves user-uploaded product images and should contain no executable code.
Verification and Hardening Script
Run this Bash script on Magento web tier hosts to audit for common StyleSmuggler follow-on artifacts: rogue PHP in media directories, recently modified core files, unauthorized admin users, and unexpected cron-based persistence.
#!/bin/bash
# StyleSmuggler compromise assessment for Magento / Adobe Commerce web tier
# Run as root or with sudo. Adjust MAGENTO_ROOT for your deployment.
set -u
MAGENTO_ROOT="${1:-/var/www/html}"
REPORT="/tmp/stylesmuggler_audit_$(date +%Y%m%d_%H%M%S).txt"
echo "=== StyleSmuggler Compromise Assessment: $(hostname) $(date) ===" | tee "$REPORT"
echo -e "\n[1] PHP files in web-accessible media/static directories (HIGH SUSPICION)" | tee -a "$REPORT"
find "$MAGENTO_ROOT/pub/media" "$MAGENTO_ROOT/pub/static" -type f \( -name '*.php' -o -name '*.phtml' -o -name '*.phar' \) -mtime -30 2>/dev/null | tee -a "$REPORT"
echo -e "\n[2] PHP files modified in last 14 days outside generated/ and pub/static/" | tee -a "$REPORT"
find "$MAGENTO_ROOT" -type f -name '*.php' -mtime -14 \
-not -path '*/generated/*' -not -path '*/pub/static/*' -not -path '*/vendor/*' 2>/dev/null | head -100 | tee -a "$REPORT"
echo -e "\n[3] Rogue admin users (review against known-good admin list)" | tee -a "$REPORT"
if [ -f "$MAGENTO_ROOT/app/etc/env.php" ]; then
DB_CREDS=$(php -r "\$c=include '$MAGENTO_ROOT/app/etc/env.php'; echo \$c['db']['connection']['default']['host'].' '.\$c['db']['connection']['default']['username'].' '.\$c['db']['connection']['default']['password'].' '.\$c['db']['connection']['default']['dbname'];" 2>/dev/null)
read -r DBH DBU DBP DBN <<< "$DB_CREDS"
mysql -h "$DBH" -u "$DBU" -p"$DBP" "$DBN" -e "SELECT user_id, username, email, created, modified FROM admin_user ORDER BY modified DESC;" 2>/dev/null | tee -a "$REPORT"
else
echo "env.php not found at expected path — check DB config manually" | tee -a "$REPORT"
fi
echo -e "\n[4] Suspicious cron persistence for web user" | tee -a "$REPORT"
crontab -l -u www-data 2>/dev/null | tee -a "$REPORT"
crontab -l -u nginx 2>/dev/null | tee -a "$REPORT"
ls -la /etc/cron.d/ 2>/dev/null | tee -a "$REPORT"
echo -e "\n[5] Shell processes spawned by web/PHP processes (last 24h, from audit log if present)" | tee -a "$REPORT"
if command -v ausearch >/dev/null 2>&1; then
ausearch -ts recent -x sh -x bash -x curl -x wget 2>/dev/null | grep -E 'php-fpm|apache2|httpd|nginx' | tee -a "$REPORT"
else
echo "auditd not installed — install and enable execve auditing for future detection" | tee -a "$REPORT"
fi
echo -e "\n[6] Listening sockets owned by unexpected processes" | tee -a "$REPORT"
ss -tlnp 2>/dev/null | grep -vE 'nginx|apache2|httpd|php-fpm|mysql|redis|sshd|elasticsearch|rabbitmq|varnish' | tee -a "$REPORT"
echo -e "\n=== Assessment complete. Review $REPORT. Any hits in section [1] warrant immediate IR escalation. ===" | tee -a "$REPORT"
Remediation
There is no vendor patch available at the time of this writing. Your defensive posture must therefore rest on compensating controls, hardening, and compromise assessment — in that order of operational reality.
-
Assume breach and hunt first. Because Sansec reports compromise of stores believed to be patched, run the detection content and audit script above before anything else. A backdoor planted weeks ago will survive every control you add today. Escalate any rogue PHP files under
pub/media/, unknownadmin_userrows, or unfamiliar cron entries to your IR process immediately. -
Deploy WAF/virtual-patching controls. With no vendor fix, your web application firewall is the primary mitigation:
- Enable and tune your WAF (ModSecurity with OWASP CRS at minimum; Fastly/Cloudflare/Imperva managed rules for Commerce customers) to inspect requests to Magento routing endpoints.
- Block all direct requests to
.php,.phtml, and.pharfiles under/pub/media/,/pub/static/, and/var/— these directories should never serve executable code. - Restrict access to
/adminand/downloaderby source IP where operationally feasible.
-
Enforce PHP execution restrictions at the web server. For nginx, deny PHP execution in
pub/mediaandvarvialocationblocks; for Apache, usephp_flag engine offin.htaccessfor those directories. This breaks backdoor execution even if file write succeeds. -
Filesystem integrity monitoring. Deploy FIM (AIDE, Tripwire, or your EDR's FIM capability) against the Magento docroot, with real-time alerting on PHP file creation outside
generated/. Magento's static-content deployment patterns make high-signal FIM rules practical here. -
Rotate credentials and audit access. Reset all admin passwords, enforce MFA on the admin panel, audit
admin_userandoauth_tokentables for unauthorized entries, and rotate any API integrations, payment gateway keys, and database credentials if compromise is confirmed. -
Monitor for the vendor patch and CISA KEV addition. Subscribe to Adobe's security bulletin feed (https://helpx.adobe.com/security/security-bulletin.html) and Sansec's disclosure channel. When Adobe ships a fix, treat it as an emergency change — exploit code for unauthenticated RCE against e-commerce platforms historically becomes commoditized within days. Watch the CISA KEV catalog for addition, which would impose BOD 22-01 remediation deadlines for federal agencies and should drive your prioritization regardless of sector.
-
Segment and egress-filter the web tier. Outbound connections from PHP workers should be allowlisted to payment gateways, shipping APIs, and Adobe services only. This converts a successful RCE into a contained event by breaking C2 and exfiltration paths.
The uncomfortable lesson of StyleSmuggler is the same one Magecart taught this ecosystem years ago: storefront platforms are high-value, internet-facing, and chronically under-monitored relative to their business criticality. If your Magento tier doesn't have process-lineage telemetry, FIM, and egress control today, this disclosure is your forcing function.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.