Sansec - GoKawiil

Researchers warn Magento's BlockStrap flaw could soon be weaponized

Sansec has disclosed CVE-2026-103849, dubbed BlockStrap, a maximum-severity vulnerability in Adobe Commerce, Magento Open Source through 2.4.9, and Adobe Commerce B2B through 1.5.3 that could let attackers execute arbitrary PHP code via a second-pass injection in the email template engine. No active exploitation has been observed yet, but Sansec says it found four potential attack paths within a day of analysis and is urging merchants to apply Adobe's October patch or isolated fix rather than relying on a standard Composer install.

bleepingcomputer.com · 2026-10-16

Unpatched Magento flaw 'StyleSmuggler' used to install Linux backdoor on e-commerce sites

Security firm Sansec has detected active exploitation of an unpatched vulnerability, dubbed StyleSmuggler, affecting all versions of Magento and Adobe Commerce. Attackers inject PHP code through the platform's template system by triggering a fake failed-payment email, which then installs a Rust-based backdoor disguised as a legitimate Linux process and sets up a cron job for persistence. Adobe has confirmed it is working on a patch but has not given a release date.

bleepingcomputer.com · 2026-09-07