Sansec's forensics team (Oct 15) named the CVSS 10.0 Adobe Commerce / Magento template-engine injection fixed in APSB26-153 "BlockStrap". It lets an unauthenticated attacker run arbitrary PHP on the store server. Affected: Adobe Commerce and Magento Open Source 2.4.9 and earlier, Commerce B2B 1.5.3 and earlier, and Mage-OS up to 3.5.0 (3.6.0, released Oct 14, has the fix). Sansec says a plain Composer install still pulls the vulnerable base version, so you must apply the 2026-oct release or Adobe's isolated patch, and keep the separate September StyleSmuggler hotfix (VULN-39341) too. Sansec has not seen attacks on live stores, but reproduced four exploit routes within 24 hours and disputes Adobe's priority 2 (30-day) rating, noting StyleSmuggler went from hotfix to mass exploitation in three days. Open Source stores on 2.4.6 or older get no public patch and need to move to 2.4.7-p10 or later. Not on CISA KEV.