Insights
How to check your Magento store is patched against BlockStrap and StyleSmuggler
On 19 October 2026, the Centre for Cybersecurity Belgium (CCB), Belgium's national cyber security centre, published a warning headed "Patch Immediately!" about BlockStrap (CVE-2026-103849), the CVSS 10.0 template injection flaw in Magento Open Source and Adobe Commerce. Sansec, who named the flaw, reproduced four working attack routes within 24 hours of Adobe's fix. As of 20 October 2026 nobody has published evidence of attacks on live stores, but a store is only safe if the fix is actually in its code. The four checks below take a few minutes and tell you where you stand.
Tested on a staging copy, then applied in an agreed window, with a rollback plan.
Why this needs checking now
- The severity is the maximum. CVE-2026-103849 is rated 10.0, with no login and no user interaction needed. The CCB says a successful attack could expose customer and payment data, change store content and disrupt the store.
- The CCB's advice is to patch "with the highest priority after thorough testing", and to step up monitoring for suspicious activity.
- Adobe's own rating is lower. Adobe gave bulletin APSB26-153 priority 2, which in its scheme means patch within 30 days. Sansec disagree, and point to StyleSmuggler, the September flaw, where mass attacks followed within days of the fix.
- Exploitation status, 20 October 2026: Adobe says it is not aware of exploits. Sansec's analysis (15 October) says "No exploitation observed yet" and has not been updated since. CVE-2026-103849 is not in CISA's Known Exploited Vulnerabilities catalog (version 2026.10.16). StyleSmuggler, CVE-2026-75650, has been in it since 8 September 2026.
For what BlockStrap is and the full patch order, see our BlockStrap explainer.
A clean deploy does not prove you are patched
Adobe shipped the October fixes as isolated patch files, not as a new Composer release, so a fresh install or a composer update still has the vulnerable code. Sansec also warn that deploy scripts that run a patch command with || true hide failed hunks, so a deploy can report success while part of the fix is missing. The only reliable test is to look at the code on the live server. Run each check from the Magento root folder.
Check 1: is the BlockStrap fix in the code?
This is Sansec's check. It counts a function that only exists once the October fix is applied.
grep -c resolveDeferredDirectives vendor/magento/framework/Filter/Template.php- 0 means the BlockStrap fix is missing.
- 1 or more means the fix is present.
- On Mage-OS, check
vendor/mage-os/framework/Filter/Template.phpinstead. Mage-OS 3.6.0, released 14 October 2026, carries the fix; Sansec list Mage-OS up to 3.5.0 as affected.
Check 2: on 2.4.8-p5, is the corrected patch applied?
The first 2.4.8-p5 October patch was missing a change for CVE-2026-91013, one of the other Critical flaws in the same bulletin. Sansec report that Adobe published the missing change separately on 14 October as 248p5-2026-10-002-CE. Both versions contain the BlockStrap fix. If you are on 2.4.8-p5:
grep -c QUOTED_LOCAL_PART_PATTERN vendor/magento/framework/Validator/EmailAddress.php- 0 means you need to apply the separate 002 patch as well.
Check 3: is the StyleSmuggler hotfix still in place?
The October patch does not include the September StyleSmuggler hotfix (VULN-39341). Adobe says the two must both be applied. Sansec's check uses Adobe's patches tool:
vendor/bin/magento-patches -n status | grep "39341\|Status"- If VULN-39341 does not show as applied, apply it before or alongside the October patch. Adobe's September notice also told merchants to rotate the encryption key and every credential that may have been encrypted with it.
Check 4: ask Adobe's version tool
If your store has the July 2026 isolated patch or later, it has Adobe's Commerce Version Tool:
php vendor/bin/patch-statusIt lists each CVE as PROTECTED, VULNERABLE or UNKNOWN. If the command does not exist, the store is missing the July patch too, which means it is behind on more than one month of fixes.
What the results mean
| What you found | What it means | What to do |
|---|---|---|
| Checks 1 to 4 all pass | Patched for BlockStrap and StyleSmuggler | Keep checking after every deploy, and review the logs for the weeks before you patched |
| Check 1 returns 0 | BlockStrap fix missing | Apply the October 2026 isolated patch for your line, on staging first |
| Check 3 fails | StyleSmuggler hotfix missing | Apply VULN-39341 and rotate the encryption key and credentials; StyleSmuggler is being actively exploited |
| Open Source 2.4.6 or older | No public patch exists | Upgrade to 2.4.7-p10 or later; Sansec note the patches for 2.4.4-p18, 2.4.5-p17 and 2.4.6-p15 need an Adobe Commerce licence |
patch-status missing | July 2026 patch and later missing | Bring the store up to the latest patch release for its line, then apply the monthly patches in order |
Patching does not undo a break-in
The CCB make the point directly: patching protects against future attacks but "does not remediate historic compromise." If your store was unpatched while StyleSmuggler attacks were running in September, check for signs that someone got in before you closed the door:
- PHP files in
pub/mediaor other upload folders, where none belong - unfamiliar or recently changed
.htaccessfiles - core files under
vendor/orpub/that differ from a clean copy of your version - script tags in checkout templates, or in Content > Design > Configuration (HTML head and footer), that you did not add
- admin users or integrations nobody recognises
If you find any of these, treat the store as compromised: keep evidence, clean it, rotate every credential and then patch. Our malware clean-up page explains how we handle it.
How EveryHost can help
- Fully Managed plan: we apply Magento security patches for you, on staging first and then to production in an agreed window, with a rollback plan. If a patch conflicts with custom code, we stop and hand it to your developer.
- Standard and Managed plans: your developer applies the Magento patch on staging and we coordinate production. If you would rather we did it, patching outside a plan is £85 an hour + VAT, and larger jobs are quoted.
- Not sure where you stand? Open a ticket with your Magento version and the output of the checks above, and we will tell you what is missing and in what order to apply it.
- Sentinel, included with every plan, is log-based monitoring that blocks at the server firewall. It is not a web application firewall and does not stop a BlockStrap request. The patch does.
Sources
All accessed 20 October 2026.
- CCB: Template injection vulnerability in Adobe Commerce and Magento Open Source, patch immediately, 19 October 2026
- Sansec: BlockStrap, Magento and Adobe Commerce RCE (CVE-2026-103849), 15 October 2026
- Adobe security bulletin APSB26-153, 13 October 2026
- Adobe KB: Security update available for Adobe Commerce, APSB26-153
- Adobe KB: Urgent action required, APSB26-146 hotfix
- NVD: CVE-2026-103849
- CISA Known Exploited Vulnerabilities catalog, version 2026.10.16
Frequently asked questions
Want us to check and patch your store?
Our Fully Managed plan applies Magento security patches on staging first, then to production in an agreed window, with a rollback plan.