Hunt the Magento payment email that runs PHP for you

Inception Security

9 hours ago

4 min read

The leftover is not a failed checkout ticket. It is a process that looks like time sync, a cron line that restarts twice an hour, and a Payment Transaction Failed Reminder that already ran PHP while Magento rendered it. Nobody needed to open the message. Delivery can fail, and the planted code still executes. That is StyleSmuggler after the styles poison, not another Magento zero-day recap. Here is the plain version before the product jargon. An unauthenticated attacker poisons Magento template handling through style properties, often via GraphQL. Magento then renders the standard Payment Transaction Failed Reminder email and runs the planted PHP during that render. Sansec reproduced the full chain on Magento Open Source 2.4.7, 2.4.8, and 2.4.9. The first victim Sansec describes ran 2.4.6-p15 with the July and August 2026 patches applied and a clean security patch status. Moving sessions to Redis or the database does not stop it. If you came in hunting a CVE string, you are hunting the wrong leftover. The case is the implant rename trail, fake NTP on UDP/123, and second-actor media-cache PHP on the same foothold.

Sansec was published early because stores were being hit. Attacks started on 4 September 2026. The page was last updated on 7 September 2026 with the chronyd, and NTP details this hunt depends on. Adobe Enterprise Support confirmed on 7 September that they were working on a patch, with no ETA. Sansec notes the next Adobe security release is scheduled for 8 September, and it is yet unknown whether that covers this bug. Until then, Sansec says you can temporarily disable GraphQL if you are not already blocking exploitation another way. A disabled GraphQL setting does not rewrite last week's auth log. How styles poison becomes a payment email that runs PHP. I am not going to reconstruct the gadget chain. You do not need the recipe. Sansec's two-stage shape is enough for the hunt shop. Stage one injects PHP into Magento's template system by abusing style properties so existing safeguards miss it. Stage two lets Magento execute that planted code when it builds the Payment Transaction Failed Reminder. Unexpected bursts of those reminders are a reason to investigate, though legitimate declines can generate the same notice. The important fact is render-time execution. The attack can succeed when email delivery fails. When the chain lands, a small Rust backdoor starts as a background process. Sansec has no indication so far that the backdoor has been weaponized beyond waiting on C2. The implant still matters because it keeps renaming itself so yesterday's process hunt goes quiet.

StyleSmuggler leftover hunts

Paste these. Bound to the Sansec artifacts above. Window starts at 4 September 2026, matching Sansec's first confirmed exploitation, through the 7 September chronyd update. They do not reconstruct the gadget chain.

Hunt StyleSmuggler leftovers in KQL

DeviceProcessEvents
| where Timestamp >= datetime(2026-09-04)
| where FileName in~ ("fc-cache", "chronyd", "gvfsd-user")
  or ProcessCommandLine has_any ("[kworker/u:8:0]", "fc-cache", "chronyd", "gvfsd-user")
| where FolderPath has_any (".gvfsd", "fontconfig", "/tmp/.fc-", "/tmp/.chrony-", "/tmp/.kw_", "/tmp/.cache_", "/tmp/fc-cache")
  or ProcessCommandLine has_any (".gvfsd", "fontconfig", "/tmp/.fc-", "/tmp/.chrony-", "/tmp/.kw_", "/tmp/.cache_")
| project Timestamp, DeviceName, FileName, FolderPath, ProcessCommandLine,
   InitiatingProcessFileName, InitiatingProcessCommandLine, AccountName

DeviceFileEvents
| where Timestamp >= datetime(2026-09-04)
| where FolderPath has_any (".gvfsd", "fontconfig/fc-cache", "/tmp/.fc-", "/tmp/.chrony-", "/tmp/.kw_", "/tmp/.cache_")
  or FileName in~ ("fc-cache", "chronyd", "gvfsd-user")
  or FileName startswith "sync_"
| where FolderPath has "pub/media" or FolderPath has_any (".gvfsd", "fontconfig", "/tmp/")
| project Timestamp, DeviceName, ActionType, FileName, FolderPath, InitiatingProcessFileName,
   InitiatingProcessCommandLine, SHA256

DeviceNetworkEvents
| where Timestamp >= datetime(2026-09-04)
| where RemoteIP in ("99.84.67.186", "185.157.160.251", "209.141.43.95")
  or RemoteUrl has_any ("ntp.timesync.to", "ntp.timesysnc.net", "ntp.synctime.to", "ntp.syncstime.to",
      "time.microsft.run", "pool.microsft.studio", "windwsecurity.run", "cdnflare.xyz", "incofar.it")
  or (RemotePort == 123 and InitiatingProcessFileName in~ ("fc-cache", "chronyd", "gvfsd-user"))
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
   RemoteIP, RemotePort, RemoteUrl, Protocol

// Auth / syslog ingest: www-data crontab deny as infection clock
DeviceLogonEvents
| where Timestamp >= datetime(2026-09-04)
| where * has "crontab command not allowed"
| where * has "www-data"
| project Timestamp, DeviceName, *
// If you forward Linux auth/syslog into a custom table, swap the table name and keep the same strings.

Hunt StyleSmuggler leftovers in Falcon CQL

event_simpleName=ProcessRollup2
| timestamp>=#2026-09-04#
| (ImageFileName=*fc-cache* OR ImageFileName=*chronyd* OR ImageFileName=*gvfsd-user* OR CommandLine=*[kworker/u:8:0]* OR CommandLine=*fc-cache* OR CommandLine=*chronyd*)

Hunt StyleSmuggler leftovers in Splunk

earliest=09/04/2026:00:00:00
(index=linux OR index=sysmon OR index=osquery OR index=crowdstrike OR index=proxy OR index=firewall OR index=web OR index=auth OR index=syslog)
(

Hunt StyleSmuggler leftovers in Kibana

@timestamp >= "2026-09-04" AND (
  (process.name:(fc-cache OR chronyd OR gvfsd-user) AND process.executable:(*tmp/.fc-* OR *tmp/.chrony-* OR *fontconfig* OR *.gvfsd* OR *tmp/.kw_* OR *tmp/.cache_*))
  OR process.command_line:(*[kworker/u:8:0]* OR */tmp/.fc-* OR */tmp/.chrony-* OR *fontconfig/fc-cache* OR *.gvfsd/gvfsd-user*)
  OR file.path:(*tmp/.fc-* OR *tmp/.chrony-* OR *fontconfig/fc-cache* OR *.gvfsd* OR *pub/media*sync_*)
  OR file.name:(fc-cache OR chronyd OR gvfsd-user OR sync_*.php)
  OR dns.question.name:(*ntp.timesync.to* OR *ntp.timesysnc.net* OR *ntp.synctime.to* OR *ntp.syncstime.to* OR *time.microsft.run* OR *pool.microsft.studio* OR *windwsecurity.run* OR *cdnflare.xyz* OR *incofar.it*)
  OR destination.ip:("99.84.67.186" OR "185.157.160.251" OR "209.141.43.95")
  OR (destination.port:123 AND process.name:(fc-cache OR chronyd OR gvfsd-user))
  OR message:("crontab command not allowed" AND www-data)
  OR message:("Payment Transaction Failed Reminder")
)

Sources

Sansec Forensics Team, “StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack” — published 5 September 2026, updated 7 September 2026. Primary source for the rename trail, NTP-shaped UDP/123 C2, crontab persistence, www-data crontab deny, media PHP shell, temporary GraphQL disable, and Adobe patch status. https://sansec.io/research/stylesmuggler

What This Means for Your Team

This case does not open on another Magento zero-day. It opens when Magento renders a Payment Transaction Failed Reminder and runs planted PHP whether mail is delivered or not. Hunt unexpected fc-cache, chronyd, and gvfsd-user paths, cron at 13,43 / 57,27 / every five minutes, fake NTP to Sansec’s UDP/123 names and 185.157.160.251, www-data crontab-deny noise, and pub/media sync_*.php behind X-Cache-Token. Constrain GraphQL while Adobes patch work continues; version-string-only hunts will miss the chronyd that is not chronyd.

Strengthening Your Defenses with Inception Protection

At Inception Security, Inception Protection is our MDR for Microsoft environments. We use the Defender, Sentinel, Conditional Access, and Azure licenses you already have. For this chain, we hunt unexpected fc-cache, chronyd, and gvfsd-user paths, UDP/123 and DNS to Sansec’s NTP-shaped C2 names, www-data crontab-deny noise in forwarded auth logs, Payment Transaction Failed Reminder bursts, and media-cache sync_*.php file creation while you constrain GraphQL and wait on Adobe’s patch work.

Assessing Your Security Posture with a Free Inception Foresight M365 Assessment

Want to see where your environment stands against StyleSmuggler leftovers like these, not just the Magento version on the ticket? Grab our free Inception Foresight M365 Assessment: https://www.inceptionsecurity.com/m365assessment. No strings. If this is useful, follow Inception Security on LinkedIn and @inceptionsec on X.