Critical RCE in Adobe Commerce/Magento allows arbitrary PHP execution

Affected Systems

Adobe Commerce and Magento installations. Specific affected versions not disclosed in available information. Vulnerability resides in BlockStrap component.

Exploitation Status

Not yet exploited in the wild. Researchers warn exploitation is imminent. No public PoC confirmed, but maximum severity rating suggests low exploitation complexity.

Business Impact

Attackers can execute arbitrary PHP code on e-commerce servers, leading to complete server compromise, data theft (customer PII, payment data), malware deployment, and supply chain attacks. E-commerce platforms are high-value targets. Patch availability not mentioned in source material.

Urgency

🔴 Immediate

Recommended Actions

• Monitor Adobe Security Bulletin (APSB) and Magento security center for emergency patches and apply immediately upon release
• Isolate Adobe Commerce/Magento instances from internet if possible until patched, or place behind WAF with strict PHP execution filtering
• Review web server logs for unusual POST requests or PHP file uploads to BlockStrap-related paths
• Audit existing server integrity for signs of compromise: unexpected PHP files, modified core files, new admin accounts
• Implement network segmentation to limit lateral movement if store servers are compromised