The first Magento store to fall was fully up to date. It ran 2.4.6-p15 with the July and August 2026 patches applied and a clean patch status check. Attackers took it anyway, three days before Adobe had a fix to ship.
The Sansec Forensics Team, which specializes in e-commerce malware, found the campaign on September 4 at 22:40 UTC and named the flaw StyleSmuggler. It needs no account and no password to run code on the store. Sansec published early, with its investigation still open, because stores were being taken over in real time, and Peru's national digital security center relayed the warning two days later.
Adobe published emergency bulletin APSB26-146 on September 7 at 20:20 UTC with priority rating 1, its highest. The flaw is now CVE-2026-75650, scored CVSS 10.0, and every release from 2.4.4 through 2.4.9 is affected across Adobe Commerce, Magento Open Source and Adobe Commerce B2B 1.3.3 to 1.5.3.
A payment failure email that runs code
Sansec describes two stages. The attacker injects PHP into Magento's template system, abusing style properties to slip past existing safeguards, then Magento executes the poisoned template itself while rendering a failed payment email. Nobody has to open that message, and the attack can succeed even when the email never sends. An unexplained burst of "Payment Transaction Failed Reminder" notices is worth investigating, though ordinary declined payments produce them too.
Sansec reproduced the full chain on clean installations of 2.4.7, 2.4.8 and 2.4.9, and says moving sessions to Redis or the database does not stop it.
An implant that pretends to be a clock
A successful attack launches a small Rust backdoor that beacons out and waits for commands. Sansec has no indication it has been used, and says no other vendor recognized it at the time of writing. The operators change payloads several times a day and have cycled through process names: [kworker/u:8:0], then fc-cache, then chronyd, the real NTP daemon on most Linux distributions.
That last name is deliberate. The implant sends 48-byte UDP packets to port 123 dressed as NTP traffic, so anyone hunting odd time-sync traffic is tempted to exclude the legitimate daemon and hide what they are looking for. Two details give it away: nine datagrams about 10 milliseconds apart every 60 seconds where a real client sends one, and every datagram marked NTPv4 server mode, which a client has no reason to send. Some builds relaunch with no cron entry at all, so an empty crontab is not evidence a host is clean.
A second, unrelated operator is riding in through the same hole and dropping a web shell into the product image cache. Killing a background process is not enough: search pub/media for PHP files, the clean-up that follows any web shell planted through a vulnerable plugin.
Apply the VULN-39341 hotfix, then rotate the keys
Adobe shipped the fix as a composer patch rather than a full release: download VULN-39341-composer-patches.zip from repo.magento.com, apply it, and confirm with the magento-patches status command. Out-of-support branches get nothing from Adobe, though Scandiweb has backported the fix to 41 older releases, unreviewed by Sansec.
Patching does not clean a store that was already hit, and stores were exploited for three days before the hotfix existed. Adobe tells merchants to rotate the encryption key and every credential it protected, from admin passwords and integration tokens to payment gateway credentials and deploy keys, at the source rather than only inside Magento, because rotating the key alone does not invalidate anything an attacker already read. Card data is the prize here, and a compromised checkout stays profitable long after the intrusion, as the skimmers hidden inside real checkout pages keep showing.
Salient indicators, defanged from Sansec's list: command and control at 99[.]84[.]67[.]186 and windwsecurity[.]run; NTP-shaped channels ntp[.]timesysnc[.]net, time[.]microsft[.]run and ntp[.]timesync[.]to, the last resolving to 185[.]157[.]160[.]251 on September 7; and attacker source 88[.]216[.]72[.]181, seen at multiple victims.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.