Critical BlockStrap flaw lets hackers run code on Magento servers

A maximum-severity vulnerability in Magento and Adobe Commerce (CVE-2026-103849, dubbed BlockStrap) could let attackers execute arbitrary PHP code on store servers, BleepingComputer reports. Security firm Sansec says no attacks have been observed yet, but warns that Adobe’s ‘priority 2’ rating understates the risk.