CRITICALVulnerability
Global

Critical BlockStrap flaw lets hackers run code on Magento servers

·Source: BleepingComputer

Updated:

Executive Summary

Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]

Analysis

Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]

Indicators of Compromise (1)

CVE (1)
CVE-2026-103849
NVDMITRE CVE
Source Attribution

Originally published by BleepingComputer on Oct 16, 2026.

Related Threats

CRITICALZero Day

October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero days

Microsoft released a record-shattering 1,407 CVEs to be plugged today on October Patch Tuesday, breaking the 2020 record of 1,261. The list was so long that its release was several hours later than the usual 1 p.m. Eastern drop time, somewhat frustrating admins. The bugs include three zero-day vulnerabilities, one of which has been exploited. The zero day being exploited, and that should be dealt

CVE-2026-96951CVE-2026-21510
CSO Online
CRITICALVulnerability

NVD CRITICAL: CVE-2026-103849 — Adobe Commerce is affected by an Improper Neutralization of Special Elements Use...

Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context of the current user, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction. Scope is changed.

CVE-2026-103849
NIST NVD
MEDIUMVulnerabilityNEW

Polymarket halts trading after crypto-draining script breach, $2.5M traced

Prediction market platform Polymarket temporarily suspended trading on Thursday after hackers compromised a third-party service to distribute cryptocurrency-draining JavaScript, with approximately $2.5 million in assets traced to a suspected attacker wallet. [...]

BleepingComputer