Unpatched StyleSmuggler Zero-Day Exploited Across Magento and Adobe Commerce Stores

Dutch security firm Sansec disclosed active exploitation, beginning 4 September 2026, of an unpatched flaw affecting Magento Open Source 2.4.6 through 2.4.9 and Adobe Commerce. Attackers plant PHP code into files Magento writes, such as failure reports, and execution is triggered automatically when the platform renders its routine Payment Transaction Failed Reminder email, requiring no user interaction. The resulting backdoor runs as a process disguised as the Linux kernel thread [kworker/u:8:0], installs binaries in the user home directory rather than the web root, and re-adds cron entries every five minutes. No CVE, patch or official workaround existed as of 6 September 2026, with the next scheduled Adobe security release set for 8 September.