Loading story…
Adobe released fixes for Blockstrap (CVE-2026-103849), a CVSS 10.0 template-engine injection vulnerability that allows unauthenticated attackers to execute arbitrary PHP on affected Magento and Adobe Commerce servers. The fixes were published on October 13 in security bulletin APSB26-153. Sansec reproduced four code-execution routes within 24 hours, highlighting the potential for rapid exploit development.
As of October 15, Sansec had not observed exploitation on live stores, but warned that attackers could develop exploits quickly. Merchants should urgently apply the October security release or Adobe’s isolated patch while retaining the separate September StyleSmuggler hotfix. Both fixes are required; the Blockstrap remediation does not replace the earlier hotfix.
See affected versions and whether adversaries are exploiting it.
6 events from the most recent confirmed update back to the earliest known activity.
Sansec reproduced four routes to code execution through Blockstrap within 24 hours of Adobe's patch release.
Adobe published security bulletin APSB26-153 with a fix for Blockstrap, assigning it priority 2 with a 30-day patching window. The October patch replaces a generic template rescan with registered placeholders.
Adobe released hotfix VULN-39341 for StyleSmuggler (CVE-2026-75650), a critical Magento email-template-engine vulnerability. This fix must remain installed alongside the subsequent Blockstrap fix.
According to Sansec, StyleSmuggler reached mass exploitation within three days of Adobe's priority 1 hotfix, providing a precedent for rapid exploitation of Magento template-engine flaws.
Sansec described how attacker-controlled child-template data can be signed and rescanned at the root level, allowing a smuggled directive to execute. It urged immediate patching rather than waiting 30 days and warned that the separate September StyleSmuggler hotfix must be retained.
Researcher vozec discovered Blockstrap, tracked as CVE-2026-103849 with a CVSS score of 10.0. The vulnerability allows unauthenticated attackers to execute arbitrary PHP on affected Magento Open Source and Adobe Commerce servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
bleepingcomputer.com
Open sourcencsc.nl
Open sourcesansec.io
Open sourceadobe.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited **CVE-2026-75650 (StyleSmuggler)**, a critical template-engine vulnerability affecting Adobe Commerce, Adobe Commerce B2B, and Magento Open Source, before Adobe released hotfix VULN-39341. Rated **CVSS 10.0**, the flaw enables unauthenticated remote code execution without user interaction by poisoning application data with PHP code that executes when Magento renders its “Payment Transaction Failed Reminder” email template. Sansec documented exploitation beginning September 4, three days before the hotfix release; CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on September 8. CrowdSec recorded **2,760 matching exploitation-attempt signals** during September 9–13 and counted **500 unique source IP addresses** by September 14, although those signals do not establish successful compromise. Reported compromises involved persistent Rust backdoors and PHP web shells, so previously exposed stores should apply Adobe’s hotfix, investigate for persistence, and rotate credentials rather than assume patching removes an existing intrusion. Rotating residential sources weaken IP-blocklist defenses, while request-level virtual patching offers incomplete protection and cannot replace the vendor fix.
Oct 9, 2026
Adobe issued security updates for multiple vulnerabilities in **Adobe Commerce**, Adobe Commerce B2B, and Magento Open Source, including `CVE-2026-71362`, which open-source reporting indicates is being actively exploited in the wild. The broader advisory also covers Adobe Campaign Classic, ColdFusion, Content Credentials tools and SDKs, and Lightroom Classic. The Commerce flaws are remotely exploitable and may enable arbitrary code execution, malicious script injection into web forms, disclosure of sensitive information, security-control bypasses, privileged access to restricted files, and temporary denial of service. NCSC Netherlands, Guyana CIRT, and bjCSIRT urged administrators to apply Adobe's updates immediately; NCSC reported no known public proof-of-concept or exploit code for the vulnerabilities it described.
Sep 12, 2026
Attackers have begun targeting **CVE-2026-71362**, a critical incorrect-authorization flaw in **Adobe Commerce**, **Adobe Commerce B2B**, and **Magento Open Source** that can let unauthenticated users hijack customer accounts. Sansec reported seeing exploitation attempts blocked by its Shield WAF and said patch analysis showed Magento mishandles customer identity within an account session, allowing a session to be switched to another customer account and exposing private customer data. Adobe included fixes for CVE-2026-71362 in its August 2026 security updates, with affected versions spanning multiple July 2026 and some August 2026 release lines before newer August builds. The same update also addressed **CVE-2026-48413**, a stored **XSS** issue, along with six additional Commerce and Commerce B2B vulnerabilities, four rated high severity. Administrators were urged to move to the latest supported `-p` release and apply Adobe’s isolated patches promptly to reduce the risk of account takeover and data exposure.
Aug 28, 2026