[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBQNM-u9o0_RUleAmlJqK4m_CXYcYUa_kwDA6QyW30G4":3},{"article":4,"iocs":56,"watch_terms":61,"solutions":62,"lesson":151},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"288b357c-65f2-405f-bf88-31a10e4dcf9f","Critical BlockStrap flaw lets hackers run code on Magento servers","critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers-eef67d","Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers. [...]","A critical vulnerability, dubbed BlockStrap (CVE-2026-103849), has been discovered in Magento and Adobe Commerce, potentially allowing attackers to execute arbitrary PHP code on store servers. While attacks have not yet been observed, security firm Sansec warns that threat actors are likely to develop exploits quickly, especially with AI assistance. The flaw impacts September versions of Adobe Commerce and Magento Open Source through 2.4.9 and Adobe Commerce B2B through 1.5.3, and requires both this fix and the previous StyleSmuggler hotfix for complete protection.","Critical BlockStrap flaw in Magento and Adobe Commerce allows arbitrary code execution.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcritical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F16\u002Fmagento.jpg","2026-10-16T20:00:59+00:00","2026-10-16T22:00:05.924243+00:00",9,[17,20,22,24,27,30],{"name":18,"type":19},"Magento Open Source","product",{"name":21,"type":19},"Adobe Commerce",{"name":23,"type":19},"Adobe Commerce B2B",{"name":25,"type":26},"Adobe","vendor",{"name":28,"type":29},"PHP","technology",{"name":31,"type":32},"StyleSmuggler","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57],{"type":58,"value":59,"context":60},"cve","CVE-2026-103849","BlockStrap vulnerability in Magento and Adobe Commerce",[25,18,21],{"controls":63,"vendors":150},[64,93,122],{"slug":65,"name":66,"problem":67,"products":68},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[69,77,85],{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":94,"name":95,"problem":96,"products":97},"patch-management","Automated patch management","Known holes get closed in days, not months.",[98,106,114],{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":55,"name":123,"problem":124,"products":125},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[126,134,142],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[],{"slug":152,"title":153,"body":154,"framework_refs":155,"framework_notes":167},"critical-magento-rce-flaw-demands-immediate-patching","Critical Magento RCE Flaw Demands Immediate Patching","The BlockStrap vulnerability (CVE-2026-103849) exposes Magento and Adobe Commerce servers to arbitrary PHP code execution, giving attackers the potential to fully compromise e-commerce environments and steal sensitive customer and payment data. The flaw affects a wide range of versions and requires two separate hotfixes to be fully remediated, increasing the complexity of the patching process and the risk of incomplete remediation. Because no active exploitation has yet been observed, defenders have a narrow window to act before threat actors — potentially aided by AI-assisted exploit development — weaponize the vulnerability. E-commerce platforms are high-value targets due to the financial and personal data they handle, making rapid patch deployment critical.",[156,157,158,159,160,161,162,163,164,165,166],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST RA-5: Vulnerability Monitoring and Scanning","NIST IR-4: Incident Handling","PCI DSS Requirement 6.3: Security Vulnerabilities are Identified and Addressed","PCI DSS Requirement 10: Log and Monitor All Access","GDPR Article 32: Security of Processing","ITIL: Change Enablement \u002F Emergency Change Process",{}]