1 post
CVE-2026-103849, dubbed BlockStrap, lets attackers run arbitrary PHP on Magento and Adobe Commerce servers via email-template directive injection.
