BlockStrap flaw puts Magento servers at code-execution risk
A critical vulnerability in Magento and Adobe Commerce could allow attackers to execute arbitrary PHP code on affected store servers. Sansec says exploitation has not been observed, but expects threat actors to develop working attacks soon.
Radwan AbdulhadiEditor and technology writer
Critical flaw threatens Magento stores
Researchers are warning that hackers could soon exploit a maximum-severity vulnerability in Magento and Adobe Commerce to execute arbitrary PHP code on e-commerce servers. The flaw, tracked as CVE-2026-103849 and dubbed BlockStrap, affects the software used to operate online stores and could give attackers a path to run code in the server environment.
According to e-commerce security firm Sansec, attacks using BlockStrap have not yet been observed. However, the company expects threat actors to find a way to exploit the vulnerability after identifying four possible attack paths in less than 24 hours. Sansec’s assessment was reported by BleepingComputer.
Affected versions and Adobe rating
The vulnerability impacts September versions of Adobe Commerce and Magento Open Source through version 2.4.9. Adobe Commerce B2B is affected through version 1.5.3. Adobe described the issue in a bulletin published on October 13 as an improper neutralization of special elements used in a template engine, leading to arbitrary code execution.
Sansec questioned Adobe’s priority 2 rating for the issue, which calls for a patch within 30 days. The security firm said the rating does not reflect the danger and urgency of the vulnerability, even though exploiting it requires a more complex attack path. Sansec argued that an attacker using an AI agent could reverse-engineer the patch and produce a working exploit in a relatively short time.
How the BlockStrap attack works
Sansec describes BlockStrap as a second-pass template engine directive injection. Under the attack scenario, attacker-controlled content in a child email template is signed and processed again at the root level. That allows a smuggled {{block}} directive to be executed, creating a route to arbitrary PHP code execution.
The company says the vulnerability exposes a gap left by the fix for StyleSmuggler, a separate issue in the same email-template engine. Adobe’s BlockStrap fix replaces generic processing with registered placeholders, preventing the vulnerable content from being handled in the exploitable way.
Administrators need both fixes
Sansec said a plain Composer installation is not enough to address the risk. Website administrators must apply Adobe’s 2026-oct release or the isolated patch provided for the issue. The company also cautioned that the BlockStrap and StyleSmuggler fixes are separate and that administrators must keep the September VULN-39341 hotfix in place.
The warning is shaped by the recent progression of the StyleSmuggler vulnerability. Sansec said that issue moved from a priority 1 hotfix to mass exploitation in three days, and described BlockStrap as having a similar level of complexity. The firm expects mass attack waves involving BlockStrap to occur soon and said it will provide an update if it detects them.
Potential impact for online stores
A successful exploit could allow an attacker to execute PHP code on a Magento or Adobe Commerce store server. The supplied research does not report confirmed BlockStrap attacks, but the combination of the possible execution path, the affected versions and Sansec’s expectation of near-term exploitation makes timely patching important for administrators of affected installations.
Sansec’s warning focuses on the vulnerability’s exploitability after the patch has been analyzed rather than on a confirmed campaign. Until mass exploitation is detected or reported, store operators should verify that the relevant Adobe release or isolated patch has been applied and that the earlier StyleSmuggler-related protection remains installed.
Sources
- BleepingComputerCritical BlockStrap flaw lets hackers run code on Magento servers
Continue chronologically
Related stories
CISA Warns SharePoint, WSO2, Adobe Flaws Exploited
CISA has issued warnings regarding actively exploited vulnerabilities affecting WSO2, Adobe Commerce, Microsoft SharePoint, and Mikrotik RouterOS.
Hackers Hijack Convertr Analytics Script to Steal Payment Cards
A credit card skimming group compromised a shared analytics script used by Brazilian e-commerce platform Convertr to steal payment data during checkout.
PHP2Shell Leaked Critical Flaws Loom Over Servers
Details on critical PHP2Shell vulnerabilities have leaked online, prompting urgent warnings of potential mass exploitation and fast patch preparation.
Mirai Botnet Operators Join PHP2Shell Attacks
Mirai botnet operators and attackers target PHP2Shell flaws as ASLR bypass exploits emerge, though no successful compromises are yet confirmed.
