Critical BlockStrap flaw lets hackers run code on Magento servers

Researchers warn of the maximum-severity vulnerability CVE-2026-103849 affecting Magento and Adobe Commerce, potentially allowing arbitrary PHP code execution on store servers. According to Sansec, attacks leveraging the vulnerability have not yet been observed, but attackers are expected to find a way to exploit it.