Act
active
Critical RCE in BlockStrap plugin for Magento/Adobe Commerce
- Engineer — Act: A public PoC on GitHub makes exploitation practical despite the low EPSS; RCE on an e-commerce server likely handling payment data warrants immediate action. Update or remove the BlockStrap plugin on all Magento/Adobe Commerce instances and verify no post-exploitation artifacts exist.
- SOC/IR — Plan: No confirmed active exploitation yet, but a public PoC means attacks could begin soon. Build or tune detections for anomalous PHP execution and unexpected outbound connections from Magento web server processes in preparation for exploitation attempts.
- Leader — Skip
- Signals: CVE-2026-103849 — CISA KEV: not listed, EPSS 0.01, public PoC on GitHub
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.