BlockStrap-RCE and PHP2Shell: Critical Magento Vulnerabilities
Executive Summary
- BlockStrap-RCE: A report on the security flaw names affected Adobe Commerce versions and notes that Mage-OS up to and including 3.5.0 is affected. Mage-OS 3.6.0 contains the fix.
- PHP2Shell: Two critical PHP vulnerabilities enable unauthenticated code execution under certain conditions. Magento store operators should check their PHP version and update it.
- Peak Season: A Magento security checklist recommends reviewing patches, admin hardening, and monitoring before the code freeze.
Adobe Commerce
Magento 2 Security Checklist for Peak Season
20 October 2026
A practical checklist for patches, admin hardening, and monitoring. The article emphasizes that Adobe is increasingly releasing security fixes as isolated patches, so the patch level cannot be determined from the version number alone.
Mage-OS
BlockStrap Vulnerability: Which Magento Patches Are Affected
17 October 2026
The article classifies the RCE vulnerability for Adobe Commerce and Mage-OS. According to the report, Mage-OS versions up to 3.5.0 are affected. Mage-OS 3.6.0, released on 14 October, contains the fix.
Magento Open Source
PHP2Shell: Critical PHP Vulnerabilities with Possible RCE
21 October 2026
Sansec describes two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Attacks require specific server conditions and do not work with every standard installation. Nevertheless, update PHP promptly. According to the current update, taking the store offline is not required.