Critical BlockStrap flaw lets hackers run code on Magento servers
Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.
Excerpt from the primary source: BleepingComputer
Who is affected
Security professionals
What you should do · Review
Review whether your organization uses the affected products and assess exposure using the linked advisories.
Automated guidance based on this story's classification. Check the linked advisories for specifics.
Sources
We link to original and authoritative sources. Headlines and excerpts belong to their publishers.
Original reporting
Related
BeyondTrust Remote Support Zero-Day Continues Trend of Exploited Edge Bugs
Ivanti, Cisco, and Palo Alto Networks all had vulnerabilities in edge devices come under fire this week. Now BeyondTrust joins the group.
There are signs this may already be exploited, which usually shortens the time available to patch.
F5, Juniper Networks Patch Critical Vulnerabilities
Successful exploitation of some of these issues could lead to remote code execution and full device takeover.
Apply the vendor's security update for the affected products.
Microsoft: October Windows update may break Smart App Control
Microsoft says some users may have trouble turning on Smart App Control after installing this month's KB5127648 Windows 11 security update.
Microsoft Patches Two Dozen RCE Flaws in Office
In addition to RCE flaws, Microsoft fixed multiple information disclosure bugs and a security bypass issue in Office.
Apply the vendor's security update for the affected products.