Critical BlockStrap flaw threatens Magento and Adobe Commerce servers
A maximum severity vulnerability in Magento and Adobe Commerce could allow hackers to execute arbitrary code on store servers.
FTMQ Security, written by our newsroom0 views
Hackers could soon exploit a maximum severity vulnerability in Magento and Adobe Commerce servers, BleepingComputer reported on October 16. The vulnerability, designated as CVE-2026-103849, potentially allows attackers to execute arbitrary PHP code on affected e-commerce store servers. [1]
According to the e-commerce security firm Sansec, attacks using the flaw, dubbed BlockStrap, have not yet been observed in the wild. However, security researchers warned that hackers are actively expected to find a way to exploit the vulnerability. [1]
The process of setting jumpers on printed circuit boards to configure hardware is often called strapping. Magento was originally founded in 2007 under Varien, Inc. before Adobe acquired Magento Commerce for 1.68 billion dollars in 2018 to integrate it into its software ecosystem as Adobe Commerce. [2][4]
Sansec based its assessment on identifying four potential avenues of exploitation, highlighting the urgency for store administrators to monitor their systems for potential malicious activity. [1]
In short
- CVE-2026-103849 is a maximum severity vulnerability affecting Magento and Adobe Commerce.
- The flaw, named BlockStrap, could allow hackers to execute arbitrary PHP code on servers.
- Security firm Sansec reported that active attacks have not yet been observed.
- Researchers identified four potential exploitation vectors for the flaw.
Sources
Every paragraph above points to the numbered items it rests on. Read the originals here.
- [1]Critical BlockStrap flaw lets hackers run code on Magento serversBleepingComputer, 9h ago (the report this story comes from)
Background
- [2]Jumper (computing) on Wikipedia
- [3]Adobe Acrobat on Wikipedia
- [4]Magento on Grokipedia
Our newsroom writes these reports with the help of software, from the 4 sources listed and nothing else, and checks them against those sources. Facts can still be wrong or move on; the originals are the record. Spotted a mistake? Write to daniel@monsterkong.com.
Related from FTMQ Security
Earlier reports of ours on the same people and subjects.
- High severity NVIDIA DCGM Exporter vulnerability threatens internet exposed GPU serversCybercrime and Scams, 7d ago
- SonicWall SMA 1000 Appliances Target of Critical Vulnerability Exploitation AttemptsTop Stories, 4d ago
More in Top Stories
- OpenAI skill repository contains hallucinated domain vulnerability affecting Render app tokens5h ago
- Researchers publish local privilege escalation exploit targeting OpenBSD 7.95h ago
- Hackers exploit BeyondTrust zero day vulnerability to hijack remote servers5h ago
- Critical PwnEscape Linux Kernel Flaw Allows VM Guest Memory Leak1d ago
- Hackers exploit Collabora CODE flaw to deploy Nextcloud backdoors1d ago
- Cisco Patches Zero Day Flaw in Secure Email Gateway2d ago
Get the day in one email
Reports like this one, the top news of the last 24 hours, every morning. Free, one email a day; readers can comment under every report.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.
Comments
Loading
Join the conversation
Comments are open to readers of our daily email: the top news of the last 24 hours, every morning, free. Sign up and the comment box opens.
Already on the list? Enter the same address and we will send a sign-in link.
By signing up you agree to our terms and privacy policy. Unsubscribe any time.