Adobe's out-of-band Magento hotfix lands after attackers installed backdoors disguised as kworker

Magento's own failed-payment email process is enough to fire the second stage ^[5]. Mail filtering and user awareness do not apply. The recipient never opens anything, and according to Imperva the attack succeeds even when the email is never delivered ^[6]. The injected PHP executes when the template renders, on the server ^[5].

Up-to-date stores are in scope too. Imperva says the flaw affects supported versions across multiple Adobe Commerce and Magento Open Source branches, including systems that had received recent security patches ^[8]. The fix is Adobe's VULN-39341 hotfix, and the advice in the disclosure is to apply it immediately and then investigate exposed systems for signs of compromise ^[16].

The only numbers on the table are Imperva's own. Its sensors put targeted sites in 15 countries ^[11]. The United States accounts for 25 percent of those sites, Mexico 15.9 percent, Spain 14 percent and Singapore 13.6 percent ^[12], which is 68.5 percent in four countries ^[17]. By sector, retail is 39.5 percent of observed targets, lifestyle 19.5 percent and healthcare 17.9 percent ^[13]. Those three carry 76.9 percent of what Imperva saw ^[18].

Imperva describes the attack traffic as primarily automated, and notes that the client identifiers behind that read can be modified or spoofed ^[14]. Retail's share tracks Magento's install base across ecommerce rather than any selection by the operators ^[13].

Imperva says its Cloud WAF and On-Prem WAF customers are protected against exploitation attempts associated with StyleSmuggler, a claim the company makes about its own product ^[15]. A blocking rule sits in front of an unfixed application and covers the payload shapes it recognizes. The same post says Imperva will keep monitoring the campaign as attackers refine their payloads ^[19].

Exploitation began before a patch existed, so the hotfix closes the injection route and leaves anything already resident untouched ^[16]. Observed post-exploitation activity has included persistent Linux backdoors disguised as legitimate processes: kworker, fc-cache and chronyd ^[9]. A separate campaign used the same flaw to install a PHP web shell, which Imperva reads as more than one actor working the bug ^[10]. Arbitrary code execution in the Magento application's context puts credential theft and payment-data compromise in reach ^[7]. For any store that was internet-facing and unpatched through this window, a current version string says nothing about whether one of those three process names is a real kernel worker.