Adobe Commerce Zero-Day Exploited to Backdoor Online Stores

Threat actors are actively exploiting a zero-day vulnerability dubbed StyleSmuggler in Adobe Commerce and Magento 2.4.7–2.4.9, abusing the platform's template system and payment failure email mechanism to inject PHP code and deploy a sophisticated Rust-based backdoor — all without requiring user interaction. The root cause is the absence of an available patch for a known attack surface in widely deployed e-commerce software, leaving merchants exposed during the critical window between discovery and remediation. What makes this particularly dangerous is the backdoor's covert command-and-control communication disguised as NTP traffic, making detection significantly harder with standard network monitoring tools. Online stores are high-value targets due to the payment card and personal data they process, meaning a successful compromise can lead to large-scale financial fraud, regulatory penalties, and severe reputational damage.