CVE-2026-103849: Critical BlockStrap RCE in Magento and Adobe Commerce — Detection, Hunting, and Remediation Guide | Security Arsenal

Researchers are warning that threat actors are likely to begin exploiting CVE-2026-103849, a maximum-severity vulnerability affecting Magento Open Source and Adobe Commerce deployments running the BlockStrap component. Successful exploitation allows an unauthenticated or low-privilege attacker to execute arbitrary PHP code on the underlying store server — which in practical terms means full compromise of the web application tier, theft of customer and payment data, webshell deployment, and a beachhead into the rest of your infrastructure.

E-commerce platforms are among the most consistently targeted assets on the internet. Magento/Adobe Commerce stores process cardholder data, sit on PCI-DSS scope, and historically attract mass scanning within days — sometimes hours — of a critical disclosure. If you operate a Magento storefront, treat this as an incident-prevention emergency, not a routine patching ticket.

Why Defenders Need to Act Now

Three factors make CVE-2026-103849 particularly dangerous:

Pre-auth PHP code execution. The worst possible outcome for a web application flaw. No stolen credentials, no insider access — an internet-facing store is directly exposed.
High-value target class. Magento stores have a long history of mass exploitation campaigns (Magecart-style skimming, webshell drops, crypto-miners). The criminal tooling and playbooks already exist; a new RCE just gets plugged into them.
Patch lag in the e-commerce ecosystem. Store operators routinely defer updates to avoid breaking checkout flows and third-party extensions. Attackers know this and time their campaigns around it.

If your store is internet-facing and unpatched, assume scanning has already begun or will begin imminently.

Technical Analysis

Affected Products

Magento Open Source installations with the BlockStrap component/module present
Adobe Commerce (on-premises and cloud-hosted instances where the vulnerable component is deployed)

Organizations should immediately inventory which stores have BlockStrap installed. In our experience, many teams don't have a clean module inventory — check app/etc/config.php, vendor/, and composer.lock on each storefront host to confirm exposure rather than guessing.

Vulnerability Profile

Attribute	Detail
CVE	CVE-2026-103849
Severity	Maximum (critical)
Impact	Arbitrary PHP code execution on the store server
Attack vector	Network (web application layer)
Prerequisites	None/minimal — exploitation targets the internet-facing application

How the Attack Works (Defender's View)

While the full technical details of the flaw are still emerging, arbitrary PHP code execution flaws in Magento-class platforms follow a predictable exploitation chain:

Crafted HTTP request to an endpoint handled by the vulnerable BlockStrap component, carrying attacker-controlled input that is ultimately evaluated or included as PHP.
Code execution in the web server process context — typically php-fpm or the Apache mod_php worker, running as www-data, apache, or nginx.
Post-exploitation: attackers almost universally write a webshell (commonly dropped into pub/media/, var/, or other web-accessible writable paths), then pivot to credential harvesting (app/etc/env.php contains DB credentials and crypto keys), payment skimmer injection, and lateral movement.

Exploitation Status

Researchers characterize active exploitation as imminent — the vulnerability is publicly disclosed, severity is maximum, and the target class is heavily automated by criminal scanners. There is no confirmed mass-exploitation campaign at the time of writing, but defenders should operate under the assumption that weaponization is underway. Do not wait for a CISA KEV listing to patch; KEV additions for e-commerce flaws historically lag actual exploitation.

Detection & Response

The detections below target the observable behaviors of exploitation and post-exploitation on Magento infrastructure: PHP/web-server processes spawning shells, webshell writes to web-accessible directories, and suspicious request patterns against BlockStrap endpoints. These are the behaviors that matter regardless of the exact exploit payload.

Sigma Rules

YAML

---
title: Web Server Process Spawning Shell on Magento/Adobe Commerce Host
id: 3f8c2a71-9b4e-4d2a-a1c6-7e5f0d8b2c44
status: experimental
description: Detects PHP-FPM, Apache, or Nginx worker processes spawning interactive shells or command interpreters, consistent with post-exploitation of a web RCE such as CVE-2026-103849 (BlockStrap).
references:
  - https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/php-fpm'
      - '/php-fpm8.1'
      - '/php-fpm8.2'
      - '/php-fpm8.3'
      - '/apache2'
      - '/httpd'
      - '/nginx'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/python'
      - '/python3'
      - '/perl'
      - '/nc'
      - '/ncat'
      - '/base64'
  condition: selection_parent and selection_child
falsepositives:
  - Rare legitimate Magento cron or deployment tooling executed through the web context; verify parent command line
level: critical
---
title: Webshell File Created in Magento Web-Accessible Directory
id: 91d4e6b2-3c7a-4f1e-b8d9-2a6c5f0e1b37
status: experimental
description: Detects creation of PHP files in Magento web-accessible writable directories (pub/media, pub/static, var), a hallmark of webshell deployment following RCE exploitation such as CVE-2026-103849.
references:
  - https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/
  - https://attack.mitre.org/techniques/T1505/003/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1505.003
logsource:
  category: file_create
  product: linux
detection:
  selection_path:
    TargetFilename|contains:
      - '/pub/media/'
      - '/pub/static/'
      - '/var/importexport/'
      - '/var/import/'
      - '/downloader/'
  selection_ext:
    TargetFilename|endswith:
      - '.php'
      - '.phtml'
      - '.phar'
      - '.php5'
      - '.php7'
  condition: selection_path and selection_ext
falsepositives:
  - Extension installation or theme deployment workflows writing legitimate PHP into these paths; correlate with change windows
level: high
---
title: Suspicious Request Pattern Against BlockStrap Component
id: 5c2a8f14-7d3b-4e9c-a6f1-8b0d4e2c9a55
status: experimental
description: Detects HTTP requests to BlockStrap-related paths containing common PHP code execution probe strings, indicating exploitation attempts against CVE-2026-103849.
references:
  - https://www.bleepingcomputer.com/news/security/critical-blockstrap-flaw-lets-hackers-run-code-on-magento-servers/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_path:
    cs-uri|contains:
      - 'blockstrap'
  selection_payload:
    cs-uri|contains:
      - 'system('
      - 'exec('
      - 'shell_exec'
      - 'passthru'
      - 'eval('
      - 'base64_decode'
      - 'php://input'
      - 'assert('
      - 'popen('
      - '/etc/passwd'
      - 'whoami'
  condition: selection_path and selection_payload
falsepositives:
  - Vulnerability scanners and authorized penetration tests; validate source IP against approved testing ranges
level: high

KQL (Microsoft Sentinel / Defender)

The query below hunts Syslog-ingested Linux process execution for web-server parent processes spawning shells or downloaders — the primary post-exploitation signal for Magento RCE. A second query covers web access log patterns if you ingest Apache/Nginx logs via CEF or custom tables.

KQL — Microsoft Sentinel / Defender

// Hunt 1: Web server processes spawning shells/downloaders on Magento hosts
Syslog
| where TimeGenerated > ago(7d)
| where Facility == "user" or SyslogMessage has_any ("php-fpm", "apache2", "httpd", "nginx")
| where SyslogMessage has_any ("/bin/bash", "/bin/sh", "/bin/dash", "curl", "wget", "ncat", "base64 -d", "python3 -c", "perl -e")
| project TimeGenerated, Computer, ProcessName, SyslogMessage
| order by TimeGenerated desc

// Hunt 2: Requests to BlockStrap endpoints with code-execution probe strings
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where RequestURL contains "blockstrap"
| where RequestURL has_any ("system(", "exec(", "shell_exec", "passthru", "eval(", "base64_decode", "php://input", "assert(", "/etc/passwd", "whoami")
| summarize RequestCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, RequestURL, RequestMethod, DestinationHostName
| order by RequestCount desc

// Hunt 3 (Defender for Endpoint onboarded hosts): file creation of PHP in web-writable dirs
DeviceFileEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any ("/pub/media/", "/pub/static/", "/var/importexport/", "/downloader/")
| where FileName endswith_any (".php", ".phtml", ".phar", ".php5", ".php7")
| project TimeGenerated, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

Velociraptor VQL

Deploy this hunt across your Magento web tier to surface both active suspicious processes and recently written PHP files in web-accessible directories.

VQL — Velociraptor

-- Hunt: Magento RCE post-exploitation artifacts (CVE-2026-103849)
-- Combines suspicious child processes of the web tier with webshell file artifacts

LET procs = SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(bash|/bin/sh|dash|curl |wget |ncat|base64 -d|python3? -c|perl -e)'
  AND Username =~ '(?i)(www-data|apache|nginx|wwwrun)'

LET shells = SELECT FullPath AS WebshellPath, Size, Mtime, Ctime
FROM glob(globs=['/var/www/**/pub/media/**/*.php',
                 '/var/www/**/pub/static/**/*.php',
                 '/var/www/**/var/importexport/**/*.php',
                 '/srv/**/pub/media/**/*.php',
                 '/usr/share/nginx/**/pub/media/**/*.php'])
WHERE Mtime > now() - 604800

SELECT * FROM procs
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, 'FILE_ARTIFACT' AS Name, WebshellPath AS Exe,
       'Mtime: ' + Mtime.String AS CommandLine, NULL AS Username, Ctime AS CreateTime
FROM shells

Remediation & Verification Script

Run this on each Magento/Adobe Commerce host to inventory exposure, hunt for existing compromise indicators, and apply compensating hardening while patching is scheduled.

Bash / Shell

#!/bin/bash
# CVE-2026-103849 exposure check & compromise hunt for Magento/Adobe Commerce hosts
set -euo pipefail

echo "=== [1] BlockStrap component inventory ==="
for root in /var/www /srv/www /usr/share/nginx/html; do
  [ -d "$root" ] || continue
  grep -ril "blockstrap" "$root"/*/app/etc/config.php 2>/dev/null || true
  grep -ril "blockstrap" "$root"/*/composer.lock 2>/dev/null || true
done

echo "=== [2] Suspicious PHP files written in the last 14 days (webshell hunt) ==="
for root in /var/www /srv/www /usr/share/nginx/html; do
  [ -d "$root" ] || continue
  find "$root" -type f \( -name "*.php" -o -name "*.phtml" -o -name "*.phar" \) \
    -mtime -14 \( -path "*/pub/media/*" -o -path "*/pub/static/*" \
    -o -path "*/var/importexport/*" -o -path "*/downloader/*" \) -ls 2>/dev/null
done

echo "=== [3] Web-server processes with shell/downloader children ==="
ps -eo pid,ppid,user,comm,args | \
  awk '$4 ~ /php-fpm|apache2|httpd|nginx/ {print}' > /tmp/webprocs.txt
ps -eo pid,ppid,user,comm,args | \
  grep -E '(bash|/bin/sh|curl|wget|ncat|python|perl)' | \
  grep -E '(www-data|apache|nginx|wwwrun)' || echo "None found."

echo "=== [4] Access log probe review (BlockStrap + RCE strings) ==="
for log in /var/log/apache2/access.log /var/log/httpd/access_log /var/log/nginx/access.log; do
  [ -f "$log" ] || continue
  grep -iE 'blockstrap' "$log" | \
    grep -iE 'system\(|exec\(|shell_exec|passthru|eval\(|base64_decode|php://input|assert\(|/etc/passwd|whoami' \
    | tail -50 || echo "No suspicious probes in $log"
done

echo "=== [5] Compensating hardening (apply only after change approval) ==="
echo "- Block direct PHP execution in media/static at the web server tier:"
cat <<'NGINX'
# Nginx snippet: deny PHP execution in writable web dirs
location ~* ^/(pub/media|pub/static|var|downloader)/.*\.(php|phtml|phar|php5|php7)$ {
    deny all;
}
NGINX
cat <<'APACHE'
# Apache snippet (.htaccess in pub/media, pub/static, var):
<FilesMatch "\.(php|phtml|phar|php5|php7)$">
    Require all denied
</FilesMatch>
APACHE

echo "=== Done. Review output before remediation. Preserve logs before cleanup. ==="

Remediation

Patch immediately. Apply the vendor-released security update for BlockStrap on all Magento Open Source and Adobe Commerce instances as soon as the fixed version is available from the vendor advisory. Reference the official source for the corrected version string and installation instructions: Adobe Security Bulletins and Advisories and the BleepingComputer disclosure. Do not wait for a KEV listing or your next maintenance window.
Inventory first. Confirm which stores actually run BlockStrap (composer.lock, app/etc/config.php). Don't assume — verify.
If patching is delayed, apply compensating controls:
- Deny PHP execution in all writable web-accessible directories (pub/media, pub/static, var) at the web server layer (see script above).
- Place the storefront behind a WAF with virtual-patching rules targeting code-execution payloads against BlockStrap paths.
- Restrict outbound egress from web servers — a compromised store that cannot reach a C2 or pull a second stage is dramatically less damaging.
Hunt before you patch. Patching a compromised host does not evict the attacker. Run the Sigma/KQL/VQL content above against at least the last 14 days of telemetry before and after remediation. Check app/etc/env.php modification times, Magento admin user tables for rogue accounts, and cron for persistence (crontab -u www-data -l, /etc/cron.d/).
Assume PCI scope impact if compromised. If you find evidence of exploitation, treat it as a potential cardholder data incident: preserve forensic images and logs, rotate DB credentials and the Magento crypt key, engage your IR retainer, and evaluate PCI-DSS breach notification obligations.
Post-patch validation. Re-run the exposure inventory, confirm the fixed component version is live on every storefront (including staging clones exposed to the internet), and verify the compensating rules remain in place as defense-in-depth.

The window between public disclosure of a Magento RCE and mass exploitation is measured in days. Patch, hunt, and verify — in that order, starting today.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub

CVE-2026-103849: Critical BlockStrap RCE in Magento and Adobe Commerce — Detection, Hunting, and Remediation Guide