Security · Updated 17 Oct, 01:30 am IST
Critical BlockStrap flaw lets attackers run code on Magento, Adobe Commerce
Why it matters for readers: It shows how a seemingly small template bug can let attackers take control of web servers, so keeping software updated matters.
- The vulnerability CVE-2026-103849 (BlockStrap) can lead to arbitrary PHP code execution on affected Magento and Adobe Commerce servers.1
- Sansec identified four potential attack paths involving the flaw in under 24 hours and says attacks have not yet been observed.1
- The flaw impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3.1
- Sansec criticised Adobe’s priority 2 (patch within 30 days) rating, saying the complexity won't stop attackers who can use AI agents to craft exploits quickly.1
- Adobe described the issue as improper neutralisation of special elements in a template engine that leads to arbitrary code execution.1
Get a brief like this every morning
Uzha reads hundreds of sources and gives you the stories that matter for your work, with every source linked. Free.
Get started