Magento and Drupal face critical remote code execution vulnerabilities

Security researchers have identified critical vulnerabilities in two widely used web platforms, Magento and Drupal, which could allow attackers to execute arbitrary code on servers.

In Magento and Adobe Commerce, a maximum-severity flaw dubbed ‘BlockStrap’ (CVE-2026-103849) allows for second-pass template engine directive injection. This enables attackers to smuggle commands through child email templates to be processed at the root level. While Adobe has assigned it a ‘priority 2’ rating, security firm Sansec warns that the complexity of the attack may not deter hackers, especially those using AI to reverse-engineer patches.

Separately, Drupal has released patches for two critical remote code execution flaws affecting all currently supported versions of its core. The issues, identified as CVE-2026-108097 and CVE-2026-108099, involve the Field UI module and the Entity List module. While some exploitation paths require contributed modules or custom code, at least one path for each flaw requires no authentication. Drupal administrators are urged to update their core versions immediately, as working exploits could emerge within days.