Critical Magento/Adobe Commerce flaw allows arbitrary PHP code execution

A maximum-severity vulnerability (CVE-2026-103849) in BlockStrap, a third-party component used by Magento and Adobe Commerce, could allow remote code execution on store servers. Exploitation is likely imminent as details emerge, posing a significant risk to e-commerce operations. The flaw's impact is broad given the widespread use of these platforms.