Sansec published its analysis on Oct 15, and BleepingComputer picked it up on Oct 16. The bug was found by a researcher Sansec credits as vozec. Adobe describes it as improper neutralization of special elements in a template engine, leading to arbitrary code execution. Adobe gave it a priority 2 rating, which means patch within 30 days. Sansec says that rating is too low: "anyone with an AI agent can reverse-engineer the patch into working exploits in a relatively short time."
Why it's the second hit in six weeks. BlockStrap sits in the same template engine as StyleSmuggler (CVE-2026-75650), the CVSS 10.0 Magento zero-day Sansec caught under attack on Sept 4. Adobe's September hotfix for that one, VULN-39341, signs trusted template directives. BlockStrap gets around it with a second-pass injection. Attacker-controlled content in a child email template gets signed, then rescanned at the root level, where a smuggled {{block}} directive runs inside Magento's rendering. Adobe's October fix replaces that generic rescan with registered placeholders. Sansec's point on timing is that StyleSmuggler went from a priority 1 hotfix to mass exploitation in three days, and it calls BlockStrap similar in complexity.
The patching traps. A plain Composer install still has the vulnerable base version. Stores need the 2026-oct release or Adobe's isolated patch. The October patch also does not include the StyleSmuggler hotfix, and Adobe's patch registry doesn't list it as a prerequisite, so teams need both. Adobe's public patches cover Open Source 2.4.7-p10, 2.4.8-p5 and 2.4.9. The 2.4.4 through 2.4.6 patches need an Adobe Commerce license, so Open Source stores on 2.4.6 or older have to upgrade. Mage-OS is affected up to 3.5.0, and 3.6.0 (Oct 14) carries the fix.
Why buyers should care. A Magento store server usually holds the encryption key, payment gateway API credentials, integration tokens and customer data, and it's often run by an agency, not the security team. Unauthenticated PHP execution there means card skimmers and a foothold in whatever that box can reach. If your brand runs Adobe Commerce, or a subsidiary or acquired brand does, find out today who owns the patch.
What we'd do today. Inventory every Magento, Adobe Commerce and Mage-OS install, including agency-hosted microsites. Apply the October patch on top of VULN-39341. Then check the code, not the deploy log: Sansec's test is grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php, where 0 means the fix is missing. Sansec notes that Composer patch plugins can skip a hunk without failing the build. For hunting, watch for PHP spawning shells, new files under pub/ and var/, and odd {{block directives in email template or CMS content. If you were exposed to StyleSmuggler in September, rerun its checks too.