GoKawiilResearchers warn Magento's BlockStrap flaw could soon be weaponized
Sansec has disclosed CVE-2026-103849, dubbed BlockStrap, a maximum-severity vulnerability in Adobe Commerce, Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3 that could let attackers execute arbitrary PHP code via a second-pass injection in the email template engine. No active exploitation has been observed yet, but Sansec says it found four potential attack paths within a day of analysis and is urging merchants to apply Adobe's October patch or isolated fix rather than relying on a standard Composer install.