exploit · Fri 16 Oct 2026 · 20:00 UTC

Critical BlockStrap flaw lets hackers run code on Magento servers

Researchers warn that hackers could soon exploit a maximum-severity vulnerability (CVE-2026-103849) affecting Magento and Adobe Commerce, potentially allowing them to execute arbitrary PHP code on store servers.

CVE

KEV from CISA · EPSS from FIRST

CVE ids in this dispatch with their KEV status and EPSS score
Id	KEV	EPSS	Reference
CVE-2026-103849	—	0.78%	NVD ↗

Get the next one first.

Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.

Follow on Telegram KEV RSS API

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.