A critical vulnerability, CVE-2026-103849, has been discovered in Magento and Adobe Commerce, allowing attackers to execute arbitrary PHP code on store servers. While no active exploitation has been observed yet, researchers have quickly reproduced multiple attack routes. This flaw, dubbed ‘BlockStrap,’ poses a severe risk to e-commerce platforms and requires immediate attention from administrators.