Executive Summary
- Critical security vulnerability: BlockStrap enables unauthenticated Remote Code Execution in Magento and Adobe Commerce. Mage-OS urgently recommends that all installations of the 3.x series update to version 3.6.0.
- Important October updates: New security patches for Magento 2.4.6 to 2.4.9 as well as the first alpha of 2.4.10 have been released. For the peak season, teams should also check outdated runtime and search services.
Adobe Commerce
BlockStrap: Magento and Adobe Commerce RCE (CVE-2026-103849)
15 October 2026
The critical vulnerability with a CVSS score of 10.0 allows unauthenticated code execution via the email template engine. Sansec has not yet observed any attacks on live shops, but was able to reproduce four attack paths. Operators should install the available security patches as a matter of urgency.
Magento Performance Optimization Before Peak Season: The 2026 Checklist
14 October 2026
A technical check before Black Friday and Cyber Monday: Redis support is dropped in the latest Adobe Commerce patches, and MySQL 8.0 and Elasticsearch 7.17 are no longer supported. Adobe Commerce Cloud intends to restrict environments with outdated services from 30 October.
Magento Open Source
Magento Releases in October 2026
14 October 2026
On 13 October, security patches for Magento 2.4.6, 2.4.7, 2.4.8 and 2.4.9 as well as the first alpha of Magento 2.4.10 were released. The patch for 2.4.8 was corrected a few hours after its release.
Mage-OS
Mage-OS 3.6.0 – Security Release
14 October 2026
Mage-OS Distribution 3.6.0 incorporates Adobe's isolated October patch 249-2026-10-001-CE and, among other things, fixes CVE-2026-103849. Mage-OS recommends this security update for all installations of the 3.x series.
muench.dev · Weekly Magento Newsletter