E-commerce security firm Sansec disclosed an unpatched zero-day vulnerability dubbed StyleSmuggler impacting Magento Open Source and Adobe Commerce deployments. The exploit chain allows unauthenticated remote attackers to achieve arbitrary code execution by abusing style properties within Magento’s layout and template rendering subsystem. By smuggling crafted directives into layout parameters, adversaries force internal framework classes to execute arbitrary PHP code directly on the underlying server without requiring prior authentication or administrative privileges.

Active in-the-wild exploitation has been observed across multiple production storefronts, where threat actors deploy persistent web backdoors, exfiltrate customer transaction data, and inject malicious payment skimmers. Independent incident response findings confirmed that the vector bypasses standard web application firewall rules targeting known Magento injection patterns, leaving thousands of internet-facing merchant environments vulnerable pending an official patch from Adobe.

Why it matters:

• Unauthenticated remote execution: Server-level code execution on store infrastructure gives adversaries persistent access to order pipelines and payment gateway handshakes, neutralizing browser-side defenses.
• Immediate supply-chain threat: Exploitation bypasses standard WAF filtering rules, requiring defenders to enforce strict path filtering on customer-facing layout endpoints and audit web roots for unauthorized PHP artifacts.