StyleSmuggler: the Magento zero-day (CVE-2026-75650) backdooring stores

On 4 September 2026 at 22:20 UTC, Sansec watched a fully up-to-date Magento store get remotely compromised by an attacker who needed no credentials, no session, and no user interaction. Adobe's emergency hotfix did not exist yet — it shipped three days later, on 7 September at 20:20 UTC. Everything in between was a live zero-day against one of the most heavily deployed e-commerce codebases on the internet. The vulnerability is now CVE-2026-75650, CVSS 10.0, and it has a name: StyleSmuggler.

The interesting part is not that Magento had another critical bug — it has a long history of them. It is what the attackers dropped afterwards: a Rust implant that renames itself chronyd, hides inside your fontconfig cache, and phones home over traffic shaped to look like NTP time-sync packets. This is malware engineered specifically so that the compromised host cannot see it. Which means the only place it is honest is on the wire.

What StyleSmuggler actually does (CVE-2026-75650)

Magento renders a lot of its email and template content through a layout system that resolves object references at runtime. StyleSmuggler abuses the template engine's styles properties to smuggle PHP past the sanitisation Adobe added after previous template-injection bugs — hence the name. The exploit runs in two stages, and the second stage is what makes it nasty:

1. Inject. The attacker submits a request that causes Magento to write attacker-controlled PHP into a failure report — a benign-looking artefact the platform generates when something goes wrong.
2. Detonate. The attacker then triggers a failed-payment email. Rendering that email deserialises and executes the poisoned template, and the injected PHP runs as the web-server user. No authentication, no admin session — anywhere the checkout flow is reachable, the bug is reachable.

Every supported branch is affected: Magento Open Source and Adobe Commerce 2.4.4 through 2.4.9, and Adobe Commerce B2B 1.3.3 through 1.5.3. Sansec confirmed working exploitation against clean installs of 2.4.7, 2.4.8 and 2.4.9 — this is not a misconfiguration bug you can lint away. If your store took payments this month, it was exploitable this month.

"But we patch fast." So did the first victim — they were running the latest security release when they were hit on 4 September, days before a fix existed. Speed against known CVEs does nothing for a zero-day. The window between first exploitation and Adobe's hotfix was roughly 70 hours, and attackers used all of it.

A backdoor built to look like the operating system

Once RCE lands, the interesting engineering starts. The payload is a Rust background process — Sansec has seen versions 2.1.4 and 2.1.5 — and almost every design decision in it is about not being noticed:

• It borrows the names of things you trust. Early samples appeared as [kworker/u:8:0] (a kernel worker thread). Later ones renamed to fc-cache (fontconfig) and then chronyd (the NTP daemon). In a process listing it reads as boring infrastructure.
• It lives where nobody looks. ~/.cache/fontconfig/fc-cache, ~/.local/share/.gvfsd/, /tmp/.chrony-<8hex>/chronyd. User cache and temp directories that no integrity baseline watches.
• It checks whether you are watching. The implant reads its own TracerPid to detect a debugger before doing anything interesting.
• Its command channel is a disguise. The primary C2 is a WebSocket over TLS (99.84.67.186:443, windwsecurity.run:443). The fallback is the clever bit: UDP to port 123, the NTP port, to hosts named to look like time servers (ntp.timesync.to, time.microsft.run, pool.microsft.studio). Only the first four bytes are real NTP header — the rest of each packet carries a chunked MessagePack record of host telemetry (hostname, user, OS version, memory and disk usage, whether it has root). A firewall that allows outbound NTP — almost every firewall — lets the whole channel through.

Persistence is a set of innocuous-looking cron lines firing every few minutes:

*/5 * * * * <home>/.local/share/.gvfsd/gvfsd-user
13,43 * * * * <home>/.cache/fontconfig/fc-cache
57,27 * * * * /tmp/.chrony-<8hex>/chronyd

A second, distinct threat actor piled in through the same hole with plain PHP web shells, gated behind an X-Cache-Token header and calling back to an interactsh oast.site domain. When a fresh RCE is public, you rarely get just one uninvited guest.

Why the host is the wrong place to look

Line the evasion up and a pattern emerges. Process masquerading as chronyd. Files in fontconfig cache. Anti-debug checks. C2 tunnelled through NTP. This payload was built by someone who assumed the victim runs endpoint tooling and log collection — and designed each layer to survive both. The web-server user that runs the exploit can, on many Magento deployments, reach enough of the host to tamper with the very telemetry you would use to catch it.

This is the recurring failure mode of e-commerce compromise: the store owner finds out weeks later, from their acquiring bank or from a customer, that cards were being skimmed. Magecart-style e-skimming and server-side card capture are exactly what a Magento RCE monetises into, and they are quiet by design on the host.

But none of the evasion touches the network truthfully. The chronyd process still has to open a socket to windwsecurity.run. The NTP-shaped beacon still goes to an ASN this store has never spoken to. The skimmed card data still has to leave the building. Masquerading fools a process list; it does not change who you are talking to.

Evasion on the host	What still shows on the wire
Renamed to chronyd / fc-cache	New outbound session to a never-seen destination
C2 tunnelled as NTP (UDP/123)	NTP packets whose payload is not NTP; volume and cadence a real client never produces
Hidden in ~/.cache, anti-debug	Nothing — file hiding has no network equivalent
Web shell gated behind a secret header	OOB callbacks to an oast.site / interactsh domain
Log tampering by the web user	The staging and exfil already crossed the network before the log was touched

The regulatory clock this starts

If StyleSmuggler dropped a skimmer on a store that takes cards, this is not only an incident — it is a payment-data breach. Under PCI DSS v4.0.1, requirements 6.4.3 and 11.6.1 — mandatory since 31 March 2025 — you are expected to manage and detect unauthorised changes to payment-page scripts and content precisely so that a skimmer injection surfaces. In the EU, an e-commerce operator of any scale caught in this can also owe a GDPR Article 33 notification within 72 hours, and — for larger operators — NIS2 incident reporting. The evidence question an auditor or regulator asks next is blunt: when did it start, what left, and can you prove the store is clean now? The remediation below is written to answer exactly that.

Remediation

A complete runbook for CVE-2026-75650. Verify every version and IOC against the Adobe bulletin APSB26-146 and the Sansec advisory before acting — this is a moving target.

1. Am I affected?

Check your Magento/Commerce version:

php bin/magento --version
# or
grep '"version"' composer.lock | grep -i 'magento/product'

You are in scope if you run Magento Open Source or Adobe Commerce 2.4.4–2.4.9, or Adobe Commerce B2B 1.3.3–1.5.3. Because attacks began before the patch existed, assume exposure even if you are current — treat every store that was internet-reachable between 4 and 7 September as potentially hit, and go to step 4 (Hunt) regardless of patch state.

2. Patch — exact fix

Apply Adobe's hotfix VULN-39341 (bulletin APSB26-146), released 7 September 2026:

# composer-based hotfix bundle from Adobe
composer require magento/quality-patches --dev
# apply, then confirm it registered:
vendor/bin/magento-patches -n status | grep -E "39341|Status"

Patching does not evict an implant that landed before you patched. It only closes the door.

3. Can't patch this hour? — compensating controls

• Virtual-patch at the WAF. Block requests that trigger the failure-report write and the failed-payment email render path; Sansec Shield began blocking on 5 September at 07:15 UTC and its signatures are a useful reference.
• Disable GraphQL if you do not need it — Sansec recommended it as an interim mitigation while the fix was pending.
• Egress-filter the covert channel. Restrict outbound UDP/123 to your known, sanctioned NTP servers only. The NTP-shaped C2 dies the moment the store cannot reach arbitrary "time servers".
• Block the known C2: 99.84.67.186, windwsecurity.run, ntp.timesync.to, ntp.timesysnc.net (185.157.160.251), time.microsft.run, pool.microsft.studio, ntp.synctime.to, ntp.syncstime.to.

4. Hunt for compromise (do this even if patched)

Map to MITRE ATT&CK: initial access T1190 (exploit public-facing app) → execution T1059 → web shell T1505.003 → persistence T1053.003 (cron) → masquerading T1036.005 → protocol tunnelling / impersonation T1572 / T1001.003 → discovery T1082.

Process and persistence:

# implant masquerading as system daemons
ps aux | grep -E 'kworker/u:8:0|fc-cache|chronyd' | grep -vE '\[kworker'
# the real chronyd lives in /usr/sbin — anything under /tmp or ~/.cache is not it
ls -la ~/.cache/fontconfig/fc-cache ~/.local/share/.gvfsd/ /tmp/.chrony-* /tmp/.fc-* 2>/dev/null
# rogue cron
crontab -l; ls -la /etc/cron.d/ /var/spool/cron/

Web shells and dropper:

# unexpected PHP under the media cache is never legitimate
find pub/media/catalog/product/cache/ -name '*.php' -mtime -14
grep -rIl 'X-Cache-Token' pub/media/ app/ 2>/dev/null

Known SHA256 implant hashes: e315687a1dfe61ef4a5a5642214db6d3b2b05d81391285eebc2af664641a26a7, b79dfdc1eed860e0b76c629d6adfce251db379b0b45a6d728d4ef483f7551420, 4352cabaa451e5a894535fbcc4d46628701303322a13745cb5479d7d0534ae8e. On the network, hunt for outbound UDP/123 to anything other than your NTP servers, and any WebSocket/TLS session to the C2 IPs above. Run eComscan to sweep for skimmers and known implants.

5. Eradicate + verify

1. Kill the implant, remove the cron entries and every file path above, delete any planted web shells.
2. Rotate the Magento encryption key and everything derivable from a full RCE: admin passwords, API tokens, integration secrets, database credentials, and any SSH keys on the host. An attacker with the encryption key can forge admin sessions long after you patch — Adobe calls this step out explicitly.
3. Re-scan payment-page scripts and diff them against a known-good baseline (this is the PCI DSS 11.6.1 control) to confirm no skimmer survived.
4. Only after patch + eradication + key rotation, confirm clean: no masquerading process, no rogue cron, no anomalous NTP egress across a full beacon interval.

Catching it while it happens

Every design choice in the StyleSmuggler implant is an argument for watching the network instead of the host. It renames itself to chronyd, hides in cache directories, checks for a debugger, and tunnels its C2 through NTP — precisely because it expects you to be reading process lists and log files. What it cannot fake is that a store which has only ever received traffic is now opening sessions to an ASN it has never contacted, on a cadence no real NTP client produces.

That is the exact case Zero Hunt's AI Traffic Analysis pillar was built for. A proprietary deep-learning model, trained on billions of PCAP sequences, runs on the appliance GPU at 2.7+ Gbit/s with four parallel inference heads — suspicious-traffic, malware-classification, attack-type, and application-fingerprinting. The fingerprinting head does not trust the label on a packet: a UDP/123 flow whose payload is not NTP, or a "time server" that no legitimate client would poll on that schedule, is an anomaly the moment it appears — not a line item in tomorrow's SIEM digest. The model watches the staging and the egress as they happen, which is the only point at which a card-skimming compromise is still cheap to stop. It runs entirely on-prem, with no cloud callbacks — the same posture your Magento host should have had.

The follow-up answer is on the offensive side. Zero Hunt's 10-agent generative pentest treats a newly-exposed checkout endpoint as a change-trigger: a fresh perimeter asset kicks off a full campaign within the hour, and the Exploit and Web agents write a per-target exploit chain with a local LLM — not an ExploitDB copy — to answer the only question that matters during a live zero-day window: is my store actually reachable this way, before an attacker proves it for me? Every attempt runs in an ephemeral, gVisor-hardened container that never touches the host, and every finding is ECDSA-signed at write time — so when the auditor asks what left and whether you are clean now, you have an evidence chain, not an estimate.

Patching fast is table stakes. Seeing the beacon that patching missed is the difference between a 70-hour window and a 70-day one.