This is a summary of public reports from Adobe, Sansec and others as of October 27, 2026. It is not security advice for your specific store. Follow the linked sources and talk to your developer or host.
On October 13, 2026 Adobe published security bulletin APSB26-153 for Adobe Commerce and Magento Open Source. The most serious issue in it is CVE-2026-103849, which the e-commerce security firm Sansec has named BlockStrap. It is rated CVSS 10.0 and, according to Sansec, lets an unauthenticated attacker run arbitrary PHP code on the store server.
What BlockStrap is
BlockStrap is a flaw in Magento's email template engine, the same part of the code as StyleSmuggler, the zero-day patched in September. Sansec describes it as a second-pass directive injection: attacker-controlled content inside a child template can end up being processed again at the root level, where a smuggled block directive runs. Adobe's October patch replaces that generic second pass with registered placeholders.
Who is affected
- Adobe Commerce and Magento Open Source up to and including 2.4.9 (September builds and earlier).
- Adobe Commerce B2B up to 1.5.3.
- Mage-OS up to 3.5.0. Mage-OS 3.6.0, released on October 14, includes the fix.
Why patch now, not in 30 days
Adobe rated the bulletin priority 2, which suggests a 30-day window, and said it is not aware of exploitation. Sansec disagrees with that urgency. It reports reproducing four different routes to code execution within 24 hours of the patch, and points out that StyleSmuggler went from hotfix to mass exploitation in three days. BleepingComputer covered the warning on October 16, and according to EveryHost, Belgium's national cyber security centre (CCB) issued a "Patch Immediately!" notice on October 19. At the time of Sansec's write-up, no attacks on live stores had been observed.
What to do
- Apply the October patch. Adobe shipped it as isolated patch files, so a plain Composer install or update still leaves the vulnerable code. The downloads per version are listed in Adobe's KB article ka-49323.
- Keep the September StyleSmuggler hotfix (VULN-39341, CVE-2026-75650) in place. It is a separate fix, it is not included in the October patch, and Sansec recommends installing it before the October patch.
- On Magento Open Source 2.4.6 or older there is no public patch from Adobe. Sansec suggests upgrading to 2.4.7-p10 or later, or using third-party backports at your own risk.
- On 2.4.8-p5, Adobe corrected the patch file on October 14 and published an extra patch (248p5-2026-10-002-CE) for a related bug in the same bulletin. Check that it is applied.
- On Mage-OS, upgrade to 3.6.0.
Check that the patch actually took
Sansec warns that a deploy can report success while part of a patch is missing, for example when a script ignores failed hunks. Check the code on the live server instead. From the Magento root, Sansec's check is:
grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php
If it prints 0, the BlockStrap fix is missing. On Mage-OS, check vendor/mage-os/framework/Filter/Template.php instead. Sansec also notes that after patching you may see an empty file with a long hash name in the Magento root. It is a lock file created by a bug in the patch, not a sign of a breach.
A note on third-party extensions and widgets
BlockStrap is a core Magento flaw, so no storefront extension can fix it for you. Patching core is the merchant's or agency's job. What you can do is ask every vendor that touches your store how their module is installed and what it can access. Claspwell runs as a thin Magento module plus a storefront widget that uses a public store key with origin checks, so no secret keys live in the browser. Our Magento chat widget security checklist lists the questions worth asking any vendor.
Where Claspwell fits
Claspwell is a catalog-aware AI sales assistant for Magento 2 and Hyvä. It answers shoppers from your synced catalog and installs typically in 3 days to 1 week once scope and access are ready. See how the Magento 2 AI chatbot works, or request an integration.