What just happened?

Heads up, Magento folks — a freshly discovered zero-day named StyleSmuggler is being abused to sneak a tiny but sneaky Linux backdoor onto stores running Magento or Adobe Commerce. The first real-world hit was spotted on September 4 (yes, while someone probably had an iced coffee), and the attackers are using the platform’s template system to smuggle PHP into a fake “payment failed” email flow to get code execution.

When the exploit lands, it drops a compact Rust backdoor that runs in the background and tries very hard to look innocent. Older builds show up as processes like kworker/u:8:0, while newer variants pretend to be fc-cache and even copy themselves to ~/.cache/fontconfig/fc-cache. For persistence they add a cron job that runs every 30 minutes.

The malware can talk to remote servers and accept commands. Early versions used TLS/WebSockets; newer ones hide their chatter as Network Time Protocol (NTP) traffic by sending UDP packets to port 123 and using hostnames that resemble legitimate time-sync hosts so network defenses may shrug and let it pass.

What you should look for and do (quick checklist)

If you want to play detective without losing your mind, start here.

  • Watch for an unusual flood of “Payment Transaction Failed” reminder emails — attackers abuse that exact template to trigger the code path.
  • Check running processes for odd names like kworker/u:8:0 or fc-cache that aren’t supposed to be there.
  • Look for a cron job set to run every 30 minutes that you didn’t create.
  • Scan for unexpected temporary files or strange copies in user caches (for example, under ~/.cache/fontconfig/).
  • Monitor outbound UDP traffic to port 123 and suspicious hostnames that look like time servers; attackers use this to mask command-and-control traffic.
  • As a precaution, rotate Magento account credentials if you suspect compromise.

Other behavioral checks the malware uses: it queries public IP lookup services (examples include ipify, icanhazip, ident.me, ipinfo.io) to discover the server’s external address, and it reads Linux tracer PID info to detect debugging/tracing. If tracing is present, it may stay quiet—still, it can install and sit there waiting.

Adobe has been notified and support has acknowledged the issue; a security update is scheduled soon but an exact patch timeline wasn’t provided at the time of reporting. Until an official fix is released, one practical mitigation is to disable GraphQL if your instance can tolerate it — this reduces one of the abuse vectors being used in the wild.

Quick reminder: Magento powers a large chunk of online shops (hundreds of thousands of installations worldwide, including many high-traffic sites), so this is not a tiny problem. If you run Magento, treat this seriously and act fast.

Want the TL;DR? Look for fake payment emails, odd background processes, suspicious cron entries, and disguised NTP traffic — and rotate credentials.