Active Exploitation of Adobe Commerce ‘StyleSmuggler’ Zero‑Day Puts Thousands of Online Stores at Risk

Security researchers have confirmed that a previously unknown vulnerability in Adobe Commerce and its Magento variant is being actively weaponised by cybercriminals. The flaw, dubbed “StyleSmuggler,” enables attackers to run arbitrary code on vulnerable storefronts and install a covert backdoor that can persist across updates.

Technical analysis shows the issue is a remote code execution (RCE) bug that can be triggered without authentication. By sending a specially crafted request to the affected platform, an attacker can inject malicious PHP code, which then creates a hidden entry point for later access. The backdoor is designed to evade typical detection tools, allowing threat actors to maintain long‑term control over compromised sites.

The ramifications for e‑commerce operators are significant. Adobe Commerce powers a sizable share of online retail, and Magento installations are common among small and medium‑size businesses. A successful compromise could expose customer data, payment details, and internal business information, while also providing a launchpad for further attacks against supply‑chain partners.

Adobe’s platforms have a history of high‑profile vulnerabilities, and the company typically releases security patches on a regular cadence. However, the zero‑day nature of StyleSmuggler means that no fix was available when exploitation began, leaving administrators with limited options beyond immediate mitigation measures.

The exploit was first reported by SecurityWeek, which cited evidence of active scanning and exploitation attempts in the wild. Indicators of compromise include unexpected PHP files in the webroot, anomalous outbound connections, and unexplained changes to core configuration files. The report warned that the threat actors behind the campaign appear to be targeting a broad range of merchants rather than focusing on a single high‑value victim.

Adobe responded by issuing an emergency advisory and publishing patches that address the underlying code flaw. The company urged all customers to apply the updates without delay, emphasizing that the vulnerability is “actively being leveraged” by malicious actors. Adobe also recommended disabling any unused modules and tightening server‑side security controls.

For merchants still running unpatched versions, experts advise a multi‑layered response: deploy the Adobe patches immediately, scan the file system for suspicious scripts, review web server logs for abnormal request patterns, and consider deploying a web application firewall (WAF) that can block known exploit signatures. Regular backups and a tested incident‑response plan remain essential safeguards.

The StyleSmuggler episode underscores the broader challenge of securing complex e‑commerce ecosystems. As online retail continues to grow, attackers are increasingly focusing on widely deployed platforms to maximize impact. Industry observers expect heightened scrutiny from regulators concerned about data‑privacy breaches stemming from such vulnerabilities.

Until the majority of storefronts are updated, security teams will likely continue to monitor for signs of exploitation. Ongoing collaboration between platform vendors, security researchers, and merchants will be critical to contain the threat and prevent similar zero‑day exploits from emerging in the future.